Start for free Start for free

Complementary User Entity Controls (CUECs)

Complementary user entity controls (CUECs) are the security steps a vendor's SOC report assumes you, the customer, will take. The vendor's controls only work as described if you do your part, such as managing your own users' access.

What are complementary user entity controls?

A "user entity" is you, the customer of the vendor. Complementary user entity controls (CUECs) are the controls a vendor's SOC 2 report expects you to run.

The AICPA describes them as controls the vendor expects customers to perform so the criteria can be met, listed in the system description. For example, if you manage your own users in a SaaS app, you are expected to secure that access.

Common CUECs include:

  • Giving access only to the right people, and removing it when they leave.
  • Protecting your own passwords, keys and admin accounts.
  • Sending data to the vendor using encryption.
  • Reviewing alerts and reports the vendor gives you.

CUECs are different from controls the vendor expects its own providers to run, called complementary subservice organization controls (AICPA). See carve-out method.

Why it matters to you

The auditor's opinion assumes you do your part. If you skip a CUEC, the vendor's controls may not protect you the way the report says, and a breach through that gap is yours to explain.

Your own auditors may ask too. If you hold SOC 2 yourself, you may need to show that you run the CUECs your key vendors list.

Contracts shift duties to customers the same way. For instance, Retool's DPA now makes you check that your use of Retool meets privacy law.

What to check

  • Find the CUEC list in the system description, often near the end of that section.
  • Copy each one into a short table with an owner on your team.
  • Check that you actually run each one, and keep simple evidence such as an access review.
  • Compare this year's list with last year's; new CUECs mean new work for you.
  • Check that your DPA and security addendum do not put more on you than the report does.

How Venpo helps

Venpo monitors your vendors' DPAs, security addenda and other public legal pages, and emails you in plain English when a change moves a duty onto you. Each vendor gets a change history, so you can see when your side of the deal grew.

Start for free

Frequently asked questions

Where do I find CUECs in a SOC 2 report?

In the system description section, usually in their own sub-section or next to the controls they relate to.

What happens if I do not implement a vendor's CUECs?

The vendor's controls may not deliver the protection the report describes. Any resulting gap is likely to be treated as your responsibility.

Related terms

Security and Compliance SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. Security and Compliance SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe. Security and Compliance Carve-Out Method (Subservice Organizations) The carve-out method is how a SOC report leaves out the controls of a vendor's own providers, such as its cloud host. The report names those providers, but the auditor does not test their controls, so you need other evidence for them. Vendor Documents Security Addendum A security addendum is the part of a contract that lists the security controls a vendor promises to keep, such as encryption, access control and incident response. Unlike a security marketing page, it is a binding promise. Vendor Documents Data Processing Agreement (DPA) A data processing agreement (DPA) is a contract that sets the rules for how a vendor handles personal data on your behalf, including security, subprocessors, breach notice and deletion. The GDPR requires one whenever it applies. Vendor Management Vendor Risk Assessment A vendor risk assessment is a check of how much risk a vendor brings, based on the data it gets, how much you depend on it and what its documents promise. You do it before you sign and again when something important changes.

Sources

Last reviewed