Vendor's Giving Vendor SOC/Due Diligence

Hi folks,

Looking to get your comments and opinions on this practice.

I work GRC in a regulated industry that requires vendor reviews. Lately I have seen many of our SMB vendors that rely primarily on SaaS cloud products sending their SaaS providers and data center SOC2's to our team for review in place of any documentation of their own security posture. Their argument is that the data is hosted/stored in their vendor's platform/datacenter, so the vendor SOC2 should cover …

center cloud comments cybersecurity data data center due diligence grc industry opinions practice products review reviews saas saas providers smb soc soc2 team vendor vendors work