Bridge Letter
A bridge letter — also called a gap letter — is a short statement your company issues covering the period between the end of your most recent SOC 2 report and the present date. It asserts that no material changes to your control environment have occurred since the report period ended.
Why customers ask for one
SOC 2 Type II reports cover a fixed window. If your report period ended in December and a prospect is reviewing you in July, seven months are formally unattested. The bridge letter fills that gap so procurement can rely on the existing report instead of waiting for your next audit.
Who writes it
Your company writes and signs the bridge letter — not your auditor. Most bridge letters are one page, cover no more than three to six months, and are issued on request during security reviews.
Observation Window — The observation window is the period a SOC 2 Type II report covers — typically 3 to 12 months — during which controls must demonstrably operate.
SOC 3 — A SOC 3 is the public, general-use version of a SOC 2 Type II report — same audit, no confidential detail, freely publishable on your website.
SOC 2 Type I vs Type II — Type I attests your controls are designed properly at a point in time. Type II attests they operated over a period. Here's which one customers accept.