Contract Manufacturers and SOC 2: Subservice Organization, Vendor, or Out of Scope?

A SOC 2 contract manufacturer question has one test: does the factory perform part of the service described in the SOC 2 system description? If the contract manufacturer injects device keys, loads firmware or handles customer data for the service, it is a subservice organization and the report must address it with the carve-out or inclusive method. If it only builds hardware, it is a vendor managed under CC9.2, or it falls outside the report entirely.

A typical setup: a hardware company sells a connected device plus a cloud platform, and the platform is what goes through SOC 2. An EMS partner builds the boards, flashes a golden firmware image and injects a unique device certificate on the line. The platform trusts that certificate to authenticate every device, so the factory step is part of the security of the service, and an enterprise buyer reviewing the SOC 2 report will look for it.

What the AICPA Description Criteria Say About Subservice Organizations and Vendors

The AICPA description criteria (DC 200) separate subservice organizations from other vendors by what they do for the system. A subservice organization is a vendor used by a service organization that performs controls that are necessary, in combination with controls at the service organization, to provide reasonable assurance that the service organization's service commitments and system requirements were achieved.

The AICPA's definition of a vendor adds that a vendor which operates such controls might also be a subservice organization. Its definition of a business partner even uses a parts supplier as the example: a computer manufacturer who works with another company that supplies it with parts.

DC3 guidance adds that third parties may perform functions or activities within one or more components of the system. The guide to SOC 2 scoping and the system description for hybrid infrastructure covers how to draw the system boundary itself.

How to Decide Whether a Contract Manufacturer Is a SOC 2 Subservice Organization

A contract manufacturer is a SOC 2 subservice organization when a control the service depends on happens at the factory. Four questions settle it for an EMS, ODM, foundry or OSAT (outsourced semiconductor assembly and test provider):

1. Does the factory create or handle device identity? Private keys, certificates or secrets that the cloud service later trusts for authentication.
2. Does the factory load software that becomes part of the system? Firmware or bootloaders that run inside the boundary the system description draws.
3. Does the factory handle data the service is responsible for? Customer data on returned units, or production data that feeds the service, such as serial-to-identity mappings.
4. Does the factory have access to the service's systems? VPN accounts, API keys to a device registry, or upload access to a provisioning service.

A yes to any of the four usually makes the factory a subservice organization for that function. Four noes make it a CC9.2 vendor, or a low-tier entry in the vendor inventory that the report never mentions.

Common SOC 2 Contract Manufacturer Cases: Keys, Firmware, Test Data and RMA

Four factory activities decide SOC 2 scope for hardware companies, and each can be designed to keep the factory in a smaller role.

Key Injection at the Contract Manufacturer Makes It a Subservice Organization

Key injection at the contract manufacturer puts the factory inside the SOC 2 system, because the service later trusts those keys to authenticate devices. AWS's device manufacturing whitepaper notes that when a contract manufacturer injects credentials into a golden image on the line, security credentials and PKI may be handled and exposed to the contract manufacturer. The same paper describes the alternative: secure elements or TPMs that the HSM vendor provisions in its own facility, so the contract manufacturer places the part on the board and never sees the keys. That design can move the subservice role from the factory to the secure element vendor.

Firmware Images Sent to the Contract Manufacturer

Firmware images sent to the contract manufacturer raise one question: can the factory alter what the devices run? If devices only boot images signed with a key the factory never holds, the factory's handling of the image matters less, and the contract manufacturer can often stay a vendor. Evidence then centres on the signing process the company controls.

Factory Test Data and Serial Numbers That Feed the Device Registry

Factory test data becomes part of the SOC 2 system when it feeds the service. Production test stations record serials, MAC addresses and sometimes the public half of each device key. When that file is uploaded to a device registry that the service uses to accept devices, the upload path, its access controls and the reconciliation of what was built against what was registered all belong in scope.

RMA Returns That Hold Customer Data

RMA returns that hold customer configuration, logs or cached data bring the repair site into scope for the data it handles. If the contract manufacturer or a repair depot receives those units, it is handling data the service committed to protect. CC9.2's point of focus on termination procedures mentions safe return of data and its removal from the vendor or business partner system, and the same logic applies to wiping returned units.

How the Carve-Out and Inclusive Methods Apply to a Contract Manufacturer

A contract manufacturer that is a subservice organization is handled with the carve-out method or the inclusive method, and carve-out is usually the practical choice for a factory. DC 200 defines the carve-out method as excluding the subservice organization's system components from the description and the examination, while the description still identifies the nature of the services performed, the types of controls expected to be performed at the subservice organization and the controls at the service organization used to monitor the effectiveness of the subservice organization's controls.

Those expected controls are the complementary subservice organization controls (CSOCs). For a factory that injects keys, CSOCs might read: provisioning stations are restricted to authorised personnel, key material stays inside a hardware security module, and provisioning logs are retained and shared with the company. The guide to CSOCs and the carve-out versus inclusive method covers the wording in more depth.

Under the inclusive method, controls at the subservice organization are subject to the service auditor's examination procedures, so the factory has to agree to testing by the company's auditor.

The guide to a data center as a SOC 2 subservice organization covers the same mechanics for colocation.

How CC9.2 Applies When a Contract Manufacturer Is a Vendor

A contract manufacturer that performs no part of the service is managed under CC9.2: The entity assesses and manages risks associated with vendors and business partners. The first point of focus asks for engagement requirements covering (1) scope of services and product specifications, (2) roles and responsibilities, (3) compliance requirements, and (4) service levels. Another asks the company to weigh threats such as financial failure, security vulnerabilities and operational disruption, all real risks with a single-source factory.

When the confidentiality category is in scope, design files, bills of materials and unreleased firmware are confidential information, and CC9.2 adds Obtains Confidentiality Commitments From Vendors and Business Partners. The SOC 2 CC9.2 vendor risk management guide covers the full criterion.

Contract Manufacturer Security Requirements: What to Ask the Factory For

Contract manufacturer security requirements for SOC 2 come down to five items, requested at onboarding and refreshed on a schedule set by the factory's risk tier:

• An ISO/IEC 27001 certificate, if the factory holds one. Check that the certificate scope names the site and the processes the company uses, such as programming and test.
• A SOC 2 or SOC for Supply Chain report, if one exists. The AICPA built SOC for Supply Chain for producers, manufacturers and distribution companies.
• A security questionnaire focused on the factory's role: provisioning station access, key handling, firmware storage and data wiping on returns.
• Contract clauses covering security requirements, confidentiality, incident notification, subcontracting limits, return or destruction of data and keys at termination, and evidence such as provisioning logs.
• A right to audit, including on-site visits, which supports carve-out monitoring when no SOC report exists.

What SOC 2 Auditors Look For With a Contract Manufacturer

SOC 2 auditors look for evidence that matches the role the system description gives the contract manufacturer. Expect requests like these:

The hardware company also operates its own controls around the factory, such as revoking certificates for scrapped units. The guide to complementary user entity controls covers how to keep a register of those obligations in both directions.

SOC 2 Contract Manufacturer Scope Comes Down to What the Factory Does for the Service

SOC 2 contract manufacturer scoping follows the work the factory does. A factory that injects keys or handles customer data belongs in the system description; a factory that only builds boards is a vendor with a contract and a periodic review. Drawing that line early keeps the audit smaller and gives enterprise buyers a clear answer when their security review asks who touches device identity. The SOC 2 for bare metal and on-prem infrastructure page covers other controls that change for companies running their own hardware, and the contact page is the place to start a scoping conversation.

Related Guides

• SOC 2 for Hardware Startups: What's in Scope When You Sell Devices, Chips or Appliances
• SOC 2 for Chip Startups: Design IP, EDA Environments, Foundries and Compute Services
• Is Firmware in SOC 2 Scope? OTA Updates, Signing Keys and Device Fleets

Frequently Asked Questions

Is a contract manufacturer a subservice organization for SOC 2?

A contract manufacturer is a subservice organization only when it performs controls the in-scope service needs, such as injecting device keys, loading firmware or handling customer data on returned units. A factory that only assembles hardware is a vendor managed under CC9.2. The AICPA description criteria define subservice organizations by the controls they perform.

Does a contract manufacturer need its own SOC 2 report?

No. SOC 2 has no rule requiring a factory to hold a SOC 2 report. Under the carve-out method, the hardware company monitors the factory through site visits, log reconciliations, questionnaires and certificate reviews. An ISO/IEC 27001 certificate or SOC for Supply Chain report, where one exists, makes that monitoring easier.

Should a hardware company use the carve-out or inclusive method for its factory?

The carve-out method is usually the practical choice for a factory. The system description names the factory, describes its service and lists the complementary subservice organization controls it is expected to operate. The inclusive method requires the factory to accept testing by the company's auditor.

How does key injection at the factory affect SOC 2 scope?

Key injection at the factory usually makes the contract manufacturer a subservice organization, because the cloud service trusts those keys to authenticate devices. Using secure elements or TPMs provisioned by the chip vendor, or provisioning devices after deployment, can move that control away from the contract manufacturer and shrink its role in the report.

What contract clauses should a hardware company have with its contract manufacturer for SOC 2?

The contract should cover security requirements, confidentiality of design files and firmware, incident notification within a set time, subcontracting limits, return or destruction of data and keys at termination, evidence such as provisioning logs, and a right to audit with on-site visits.

Sources

• AICPA, 2018 SOC 2 Description Criteria (DC 200, Revised Implementation Guidance 2022)
• AICPA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
• AICPA, SOC for Supply Chain guide
• AWS, Provisioning device identity in the manufacturing supply chain
• ISO, ISO/IEC 27001:2022 Information security management systems