A Type 2 report covers a fixed observation period, and the moment that window closes, a gap starts growing between what the report proves and what a customer is buying today. When a reviewer receives a report whose period ended eight months ago, the standard ask is a bridge letter: management’s dated statement that the control environment has not materially changed since. It is a representation, not an audit — no independent testing sits behind it — which is why it accompanies a report rather than extending one, and why reviewers never accept it alone.
Management signs — commonly the CISO, CTO, or CEO — and the letter covers the stretch from the last report period’s end to the date it is issued, which in practice means until the next report arrives. About three months of gap is comfortable; reviewers grow skeptical past six. For a complete example you can adapt, the clauses every letter needs, and how reviewers treat longer gaps, see the full SOC 2 bridge letter guide.
