Does the scope of a SOC 2 audit cover your own service providers and suppliers?

If you work with any third parties to support the delivery of your service that are responsible for your information security controls (either fully or partially), these third parties will be termed a ‘subservice organisation’ in a SOC 2 context and will need to be identified within your SOC 2 report.  The report will also need to identify the SOC 2 criteria and the information security controls they are responsible for, and how it fulfils your requirements for those controls.

Here, the ideal scenario is for your subservice organisations to have their own SOC 2 report, as this can be used as evidence.  However, if the subservice organisation does not have a SOC 2 report but does have an ISO 27001 certification, for example, you can utilise information relating to this certification and the controls they have in place to maintain it.