Is a SOC 2 report enough for due diligence?

A SOC 2 report can be an important part of supplier due diligence because it provides independent assurance over a defined system, criteria, scope and review period. It does not answer every question about the customer-specific relationship, current external exposure, subcontracting, business criticality or controls outside the report scope. Review the report in context and combine it with other evidence where the relationship warrants deeper assurance.