SOC 2 bridge letter

A bridge letter (or gap letter) covers the stretch between the end of your last SOC 2 report period and a customer's year-end. Your management signs it, not your auditor (Grant Thornton, Linford & Co).

Key facts

Issued by: the service organization's management, on its letterhead (source).
Covers: typically no more than 3 months (Drata, Linford & Co).
Assurance: none from the auditor. It is not an audit deliverable (source).

What to include

Drata lists these standard elements (source):

The review period of your latest SOC report (start and end dates)
Any material changes to your control environment, with an explanation
If nothing changed: a statement that management is unaware of material changes that would affect the auditor's opinion
A note that the letter does not replace a SOC 2 report
A disclaimer that it is intended only for the recipient customer

Frequently asked questions

What is a SOC 2 bridge letter?

A letter, also called a gap letter, that covers the period between the end of your last SOC 2 report and a customer's calendar or fiscal year-end, stating whether controls have materially changed.

Who signs a bridge letter?

Your own management, on company letterhead. Not the service auditor. Grant Thornton and Linford & Co both state bridge letters are not audit deliverables.

How long can a bridge letter cover?

Drata and Linford & Co state they typically cover no more than three months.

Can a bridge letter replace a SOC 2 report?

No. It supplements the most recent report and carries no independent testing or auditor opinion.

Last verified 2026-10-16. Not legal or audit advice.