Episode 9 — Subservice Orgs: Inclusive vs Carve-Out

SOC 2 engagements often depend on third-party providers—cloud platforms, payment processors, or data centers—known as subservice organizations. The inclusive versus carve-out distinction determines whether these providers’ controls are explicitly included within the system boundary or excluded but referenced through complementary user entity controls (CUECs). Inclusive reporting increases transparency but adds testing complexity, as evidence from the provider must be verified. Carve-out reporting, in contrast, assumes customers manage assurance through the provider’s separate SOC reports. Candidates must understand this distinction for accurate scope and evidence mapping.

In real scenarios, organizations frequently rely on cloud infrastructure providers like AWS or Azure under a carve-out model, referencing their SOC reports to demonstrate inherited control coverage. Inclusive models are rarer and used when the organization exercises operational control over subservice processes. The choice impacts audit depth, cost, and risk allocation. From an exam standpoint, identifying the correct model and documenting dependencies through clear control mapping ensures that external services do not introduce unmitigated risks to system reliability. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.