Bridge letter
A bridge letter — also called a gap letter — is a short statement a company issues to cover the months between its last SOC 2 report’s period end and the present, affirming that controls have continued operating without material change. Your company signs it, not your auditor.
A short statement, signed by a service organization’s management, covering the gap between the end of its most recent SOC 2 report period and the present, and affirming that the control environment has not materially changed. Also called a gap letter.
Bridge letter.
Glossary · Bridge LetterCovering the months a report can’t
A Type 2 report covers a fixed observation period, and the moment that window closes, a gap starts growing between what the report proves and what a customer is buying today. When a reviewer receives a report whose period ended eight months ago, the standard ask is a bridge letter: management’s dated statement that the control environment has not materially changed since. It is a representation, not an audit — no independent testing sits behind it — which is why it accompanies a report rather than extending one, and why reviewers never accept it alone.
Who signs, and where the template lives
Management signs — commonly the CISO, CTO, or CEO — and the letter covers the stretch from the last report period’s end to the date it is issued, which in practice means until the next report arrives. About three months of gap is comfortable; reviewers grow skeptical past six. For a complete example you can adapt, the clauses every letter needs, and how reviewers treat longer gaps, see the full SOC 2 bridge letter guide.
Glossary
Bridge letters in hours, not weeks
Agency drafts customer-ready bridge letters — and keeps the underlying controls genuinely unchanged. 1,000+ companies served since 2021.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integrationAuditsuisse AIAI-powered evidence collection and analysis for IT audits.Find your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
The long-form FAQ on how managed GRC and virtual CISO coverage work together.
Read the FAQMore from Agency
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.