SOC2 - complementary user entity controls

My company has a SOC 2, customer is asking if we have "complementary user entity controls" in our report. To be honest I never heard of that term nor do I see it in my SOC 2. Is this required? How bad does it look if I tell the customer that I don't see any.

However, I did find a line item that says "`complementary user entity controls and complementary subservice organization controls how those controls interact with related controls …

asking bad controls customer cybersecurity don report soc soc 2 soc2