Complementary user entity controls (CUECs)
Complementary user entity controls (CUECs) are the controls a service organization’s customers must operate themselves for the service’s controls to work as intended — listed inside the SOC 2 system description. The vendor secures the platform; you still have to enforce MFA, deprovision your own users, and act on the reports it sends.
Controls that a service organization’s SOC report assumes its customers (user entities) will implement themselves — such as managing their own user access and configuring security settings — without which the service’s controls cannot fully achieve their objectives.
No service controls everything end to end.
Glossary · Complementary User Entity ControlsAssumptions written into the report
No service controls everything end to end. A hosting platform can encrypt storage and patch hypervisors, but it cannot stop a customer from handing out admin credentials — so its report states, control by control, what user entities are expected to handle. Typical CUECs: provision and deprovision your own users promptly, enforce MFA on your accounts, configure security settings per the documentation, and review the alerts and reports the service delivers to you. They live in the system description, usually as a dedicated table near the end.
Why reviewers check them
CUECs turn a vendor’s report from a verdict into a shared-responsibility contract: the auditor’s opinion holds assuming the customer side is done. A reviewer running a vendor security review reads the CUEC list as their own to-do list — if your team never enforced the MFA the report presumes, the assurance you think you bought quietly evaporates. The logic also runs both directions: your customers read your CUECs the same way, and your own auditor may sample whether you actually operate the CUECs of critical vendors like your cloud provider.
If you’re the one issuing the report
Your CUEC list is also a responsibility-scoping tool: it marks where your obligations end and the customer’s begin. Keep it short, testable, and honest — a page of vague customer duties reads as blame-shifting, and the sharp reviewers described in SOC 2 in due diligence notice.
Glossary
Reports read all the way through
Agency reviews vendor reports — CUECs included — and operates your side of the bargain. Rated 4.9 out of 5 stars on G2.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integrationAuditsuisse AIAI-powered evidence collection and analysis for IT audits.Find your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
The long-form FAQ on how managed GRC and virtual CISO coverage work together.
Read the FAQMore from Agency
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.