ISC SOC Reports · Updated November 2026
Carve-Out or Inclusive: Is the Subservice Organization Inside the SOC Scope?
The distinction is whether relevant subservice-organization controls are excluded from or included in the SOC engagement scope.
Carve-out
The subservice organization's relevant controls are excluded from the service auditor's scope, while the dependency is described appropriately.
Inclusive
The subservice organization's relevant services and controls are included within the SOC engagement scope.
Why carve-out is easier
The service auditor does not directly test the subservice organization's controls as part of the same scope under the carve-out method.
Do not confuse CUECs
CUECs relate to user entities, while carve-out vs inclusive concerns subservice organizations.
The takeaway
Carve-out excludes subservice controls from scope. Inclusive brings them into scope.
Related Summit guides
FAQ
Does carve-out mean the subservice organization is irrelevant?
No.
Does inclusive require more direct service-auditor work?
Yes.
Are CUECs and CSOCs identical?
No.