ISC SOC Reports · Updated November 2026
CUEC vs CSOC: Who Is Supposed to Perform the Control?
The difference is which outside party is expected to perform the complementary control.
CUEC
A Complementary User Entity Control is a control the service organization's customer is expected to implement.
CSOC
A Complementary Subservice Organization Control is expected to be performed by a subservice organization used by the main service organization.
Example
A payroll processor can be the service organization, its client the user entity, and a cloud hosting provider a subservice organization.
The takeaway
CUEC belongs to the customer. CSOC belongs to the service provider's vendor.
Related Summit guides
FAQ
Does the service auditor perform the CUEC?
No.
Is a subservice organization the same as the user entity?
No.
Why do complementary controls matter?
The SOC report can assume controls exist outside the service organization.