A subservice organization is a specific type of vendor engaged by another organization, called the service organization, to perform critical tasks that impact the service commitments and system requirements towards the service organization's user entities. They perform some of the critical controls that you rely on for service delivery. Identifying subservice organizations is crucial for SOC 1 and SOC 2 compliance, as their controls need to be factored into your audit scope. This short course gives an overview of subservice organizations.

This overview course may be appropriate for professionals at all organizational levels.