SOC 2 Bridge Letters for Health Tech Vendors: What Healthcare Customers Accept Between Reports

A SOC 2 bridge letter covers the months between the end of your last SOC 2 report period and your next report. It's a signed statement from your management, on your letterhead, telling your healthcare customer that nothing material changed in the controls your auditor already tested. It is not issued by your auditor, and it carries no independent assurance.

Healthcare organizations run annual vendor reviews on their own schedule, and that schedule rarely lines up with yours. When their review lands two months after your report period ended, they need something to fill the gap. The bridge letter is that something, but only if you've already been through an audit.

Key Points

• A SOC 2 bridge letter is a management-signed statement on your letterhead asserting that no material changes occurred to the controls your auditor tested during the period after your last report ended. It carries no independent assurance because your auditor does not sign or endorse it.
• Healthcare organizations run annual vendor reviews on schedules that rarely align with your SOC 2 report periods, so when their review lands months after your report ended, they request a bridge letter to cover the gap alongside your most recent report.
• A bridge letter must reference your prior report by auditor name, report type, Trust Services Criteria, and exact period. It should then state the bridge period dates and plainly disclose any material changes to controls or system description, with signature from an authorized officer like the CEO or CTO.
• Healthcare customers' reviewers typically accept bridge letters for gaps up to about three months, but beyond that they start demanding a new report rather than relying on six months of management self-attestation without independent testing.
• Before your first SOC 2 report exists, a bridge letter is off the table because there is no prior examination period to bridge from. Instead, send your engagement letter showing the audit is underway, your security policies, and a completed security questionnaire.
• When reviewing your own vendors' SOC 2 reports during your audit, collect every bridge letter they issued. You need the complete chain to show coverage for your entire examination period with no gaps.

What is a SOC 2 bridge letter?

A SOC 2 bridge letter is a statement from your management. You write it, you sign it, and you put it on your company's letterhead.

It states that, for a defined period after your most recent SOC 2 report ended, no material changes occurred to the controls your auditor examined.

In plain terms, it tells your customer that what the auditor tested is still operating the same way.

The report carries the auditor's independent opinion. The bridge letter carries only yours.

SOC 2 bridge letter, gap letter, same thing

You'll hear "SOC 2 gap letter" and "SOC bridge letter" used interchangeably. Some healthcare procurement teams say "bridge letter," others say "gap letter."

They mean the same document. Don't let the terminology slow down a customer request.

When healthcare customers ask for one

Healthcare organizations review their vendors on a cycle, usually annual, that has nothing to do with when your SOC 2 report period ends.

If your Type 2 report covers January through December of last year, and their vendor review happens three months later, you have a gap. That's when the request comes in.

Our clients have asked us whether they can issue a bridge letter for that gap 6 times, from 3 clients, some of them while answering a customer's security questionnaire. Our guide to healthcare security questionnaires covers the rest of that review.

The request usually comes in one of three forms:

• The reviewer notes your report has expired and asks for a current one. They want the next report. If it's not ready, a bridge letter is the interim answer.
• The reviewer asks directly for a bridge letter covering the months since your report period ended. They already know what they need and want you to produce it.
• The reviewer points out that their review period runs past the end of your report period. They're telling you there's a coverage gap and waiting for you to close it.

In each case, the customer's reviewer will accept the bridge letter only alongside your most recent SOC 2 report.

What a bridge letter includes

A bridge letter includes these items:

• Your company letterhead. This is management's statement, so it comes from you.
• Reference the prior report. Cite the auditor's name, the report type (Type 1 or Type 2), the Trust Services Criteria covered, and the exact report period.
• State the start and end dates the letter covers. The start date is the day after your last report period ended.
• If nothing changed, say plainly that there are no material changes. Cover the system description and how the controls operate.
• If something changed, describe it. Omitting a known change undermines the letter's credibility and your customer's trust.
• Signature of an authorized officer. Typically the CEO, CTO, or head of security.
• Date when you issue it.

A bridge letter usually fits on one page.

If yours runs longer, you're probably including detail that belongs in the report itself or in a separate control narrative.

Structuring your SOC 2 bridge letter template

If you're building a SOC 2 bridge letter template for your company, start with the elements above and create fill-in fields for the report reference, bridge period dates, and the change disclosure section.

Keep the no-change statement as your default language, and add a conditional block for when you do need to disclose something. One template handles both scenarios.

The difference between SOC 2 Type 1 vs Type 2 matters here. A bridge letter after a Type 1 report rests on a test of control design on a single date. One after a Type 2 rests on controls tested over a period, so reviewers give it more weight.

Who writes, signs, and issues a SOC 2 bridge letter

Your management writes, signs, and issues the bridge letter. Specifically, someone with authority to represent the company's control environment.

That's usually the CEO, CTO, or the person responsible for your security program.

Your auditor does not sign, co-sign, or endorse it. No one independently tests what it says, so its weight rests on your credibility with the customer.

What a bridge letter cannot replace

A bridge letter cannot substitute for a SOC 2 report. It cannot introduce new controls or new systems that weren't part of the original exam. And it cannot extend the auditor's opinion to a period the auditor never tested.

A software client of ours considered pushing its annual SOC 2 audit back a few months so a new version of its platform could be included in the scope. They asked whether a bridge letter would cover the gap for their customers in the meantime.

It wouldn't. A bridge letter says nothing about a system that was never in an audited period.

The client kept the audit on schedule, with the exam period set to the full twelve months.

If you want to understand how auditor-tested controls interact with controls you inherit from infrastructure providers, our guide on inherited controls covers that relationship in detail.

How long can a bridge letter cover?

The AICPA's SOC 2 guidance sets no rule for bridge letters, because they sit outside the audit. In practice, healthcare customers' reviewers accept a bridge letter for a short gap, usually up to about three months.

Past three months, reviewers start asking harder questions. By six months, many healthcare organizations want a new report.

A report period ending in December with the next audit starting in July is a red flag. You're asking your customers to rely on your word for half a year without any independent testing. Tighten your audit cycle instead.

As part of our SOC 2 compliance services, we prepare the bridge letter when a client's report lapses before the next one is issued. That way there's no scramble when the customer's vendor review arrives.

If you're preparing for your first SOC 2 or tightening your readiness between audits, grab our free SOC 2 Readiness Checklist. It covers 70 items across ten sections.

No report yet: what to send while your first audit is in progress

A bridge letter is off the table before your first report exists. There's no prior exam period to bridge from, no auditor-tested controls to reference, and no basis for stating "nothing changed."

If a healthcare customer asks for your SOC 2 while your first audit is still in progress, send what exists:

• Your engagement letter or audit timeline. This shows you've hired an auditor and the audit is underway, with an expected completion date.
• If you completed a readiness assessment or gap analysis, a summary of findings and where you stand on remediation. This tells the customer you've done the preparation work.
• Your security policies. Include information security, access control, and incident response policies to show the foundation is in place.
• A completed security questionnaire. A filled-out SIG, CAIQ, or your own vendor questionnaire alongside the evidence above.

Four of our clients have asked us what to give customers while their audit was still running. Buyers usually accept evidence that you are in an audit with a defined completion date, so we put these items together and adjust them to what each customer's reviewer asks for.

This is also where post-audit remediation planning helps. If your readiness assessment surfaced gaps, showing the customer your remediation plan and progress gives them confidence you're closing those gaps before the report is issued.

When a bridge letter does not apply

A few situations where a bridge letter is the wrong tool:

• You've never completed a SOC 2 audit. With no prior period, there is nothing to bridge.
• You changed your system significantly. The letter must disclose a major platform rewrite, a new data center or a new way of processing customer data, but it gives the customer no assurance about it. That takes an audited period.
• Six or more months have passed since your last report ended. Many reviewers won't accept a bridge letter for a gap that long, so schedule your next audit sooner.
• Your customer's policy rules it out. Some healthcare organizations' vendor review policies require a current report, so ask early and plan around it.

When you're unsure whether your situation fits, the honest move is to ask your customer's reviewer what they'll accept before you draft anything.

Checking your own vendors' bridge letters

As a health tech vendor going through your own SOC 2, you review your vendors too.

The same bridge letter rules apply in the other direction.

When we review a vendor's SOC 2 report as part of a client's audit, the first thing we check is the report's period. If it doesn't cover the client's exam period, we ask the vendor for the newer report or for a bridge letter that covers the gap.

Collect every bridge letter

For one client's SOC 2, a provider had issued several bridge letters over the course of the year.

We had to collect all of them to show coverage for the client's full audit period. A single bridge letter might cover January through March, another April through June. You need the complete chain.

When you verify your vendors' certifications and reports, check that each vendor's report and every bridge letter together cover your entire exam period with no gaps.

A missing letter leaves a gap your auditor can ask you to explain.

Frequently asked questions

What is the purpose of a SOC 2 bridge letter?

A SOC 2 bridge letter helps customers evaluate a vendor during the period after the last SOC 2 report ends and before the next report is issued. It provides a time-bounded management statement intended to support vendor reviews that do not align with your audit cycle.

Why do I need a SOC 2 report?

Many customers use a SOC 2 report as standardized evidence of how you manage security and related controls. It can reduce repetitive due diligence and shorten procurement cycles during vendor onboarding.

Is SOC 2 legally required?

SOC 2 is generally not a legal requirement, but it is often a contractual or procurement requirement. In practice, customers may require it to do business with you, even if no law explicitly mandates it.

How long does a SOC 2 audit take?

Timing varies by scope and readiness, and by whether you pursue Type 1 or Type 2. Most teams should plan for multiple phases including readiness, evidence collection, and the audit window itself. Type 2 typically takes longer due to the operating period.

What should we include as attachments with a SOC 2 bridge letter to satisfy a healthcare vendor review?

Include your most recent SOC 2 report and ensure the bridge letter clearly references it, including the report period and the Trust Services Criteria covered. If the customer asks for additional support, provide targeted evidence for any key control areas they prioritize, rather than a large, unfocused document dump.

Who should review and approve a SOC 2 bridge letter internally before it is sent to a customer?

Have the control owners validate that no material control changes occurred during the bridge period, then route it through security leadership and legal for risk review. This helps ensure the statement aligns with internal change records and your customer commitments.

How should we handle customer redlines or requests for stronger wording in a SOC 2 bridge letter?

Treat redlines like contract language. Align on a version that stays factual and time-bounded, and avoid implying independent assurance or auditor endorsement. If a customer insists on stronger guarantees, offer alternative evidence such as updated questionnaires or specific control artifacts for the bridge period.

Keep your audit cycle tight and your bridge letter honest

A SOC 2 bridge letter works when the gap is short, the controls haven't changed, and you've already been through an audit.

It can't stand in for a first report, and it doesn't cover systems your auditor never tested.

The best thing you can do for your healthcare customers, and for your own sales cycle, is keep your audit on a tight schedule so the bridge letter stays short or unnecessary. When you tighten the cycle, you reduce the gap between report periods. That means fewer bridge letters and less friction during vendor reviews.

If your report lapsed and a customer is asking questions, or if you're heading into your first audit and need to know what to send in the meantime, talk to our team. We handle bridge letters, readiness packages, and the full SOC 2 program so a vendor review doesn't catch you off guard. Cancel anytime. If you're not saving 100+ hours, you don't pay.