What counts as vendor assurance?

Whatever the obligation asks for — a SOC 2 report, a certificate, a signed questionnaire — filed against the controls it supports.

What happens when a report expires?

The same thing that happens to any other evidence: the control it supported stops being current, and coverage reflects that.

The vendors you depend on, the evidence they owe you, and what expires when — tracked on the same cadence as everything else.

Request a call →Early access · work email only

What each vendor owes you, held to the date it expires

What counts as vendor assurance?: Whatever the obligation asks for — a SOC 2 report, a certificate, a signed questionnaire — filed against the controls it supports.
What happens when a report expires?: The same thing that happens to any other evidence: the control it supported stops being current, and coverage reflects that.