Complementary user entity controls

Controls that a service organisation assumes its customers (user entities) will operate for the Trust Services Criteria to be met, listed in the system description. Typical examples: managing your own user accounts in the vendor's product, reviewing access reports, and telling the vendor when staff leave. When you read a vendor's SOC 2, check this list, because the auditor's opinion assumes you are doing these things; the sibling term, complementary subservice organisation controls, covers the vendor's own suppliers.