Your Vendor's SOC 2 Report Doesn't Say Who's Watching Your Data. Their Staff Roster Does

November 13, 2026

Ric Hall, CRO— AI-assisted and reviewed prior to publication.

A vendor's SOC 2 report tells you what controls existed on the day of the audit. It does not tell you whether the person who configured those controls, or the person reviewing your contract renewal next quarter, actually knows what they're doing. Regulators have started asking that second question directly, and it shows up as a named line item in due diligence, not a footnote.

What Do Regulators Actually Require You to Prove About Vendor Staff?

The federal banking agencies have said for years that due diligence on a third party has to include its people, not just its paperwork. The joint guidance from the Federal Reserve, FDIC, and OCC specifically calls for evaluating a third party's staffing levels and qualifications, including whether the third party's training programs leave employees knowledgeable about applicable laws and regulations and whether they hold the requisite certifications and licenses for the activity. That is not a suggestion buried in an appendix. It sits alongside financial condition and legal compliance as a core due diligence category.

The OCC's community bank guide repeats the same language almost word for word, instructing examiners and bank staff to assess the third party's staffing levels and qualifications against its obligations to the bank, down to the credentials of principals and key personnel. And the agencies are not done revisiting this. A newly proposed update to the interagency third-party guidance, published in the Federal Register, keeps the staffing and expertise requirement intact while sharpening the expectation that higher-risk relationships get more frequent, more detailed monitoring of exactly who is doing the work.

European financial firms face a parallel, more codified version of the same demand. Under DORA, financial entities must undertake all due diligence on prospective ICT third-party service providers and ensure throughout the selection and assessment processes that the provider is suitable, with the obligation to remain fully accountable regardless of what the vendor's own controls say on paper. A SOC 2 attestation or ISO certificate can satisfy part of that suitability test, but neither one answers who on the vendor's staff is accountable for keeping the control operating correctly after the audit window closes.

How Does This Change What Shows Up in a Vendor Questionnaire?

It adds a field that used to be implicit: name the certified individuals responsible for this engagement. Standardized questionnaires like SIG and CAIQ have always asked about security programs and control ownership, but procurement and compliance teams at regulated firms are increasingly tying specific named roles, and the credentials behind them, to contract renewal rather than accepting a generic "our team is trained" response.

That shift tracks with how NIST frames supply chain risk management for anyone building or buying systems. NIST SP 800-161r1 explicitly lists the categories of personnel a cybersecurity supply chain risk program depends on, including acquisition and procurement officials, system security engineers, and individuals with security and privacy assessment and monitoring responsibilities. The publication treats staffing composition as a control in itself, not an afterthought to the technical architecture. If your vendor can't map specific credentialed people to those roles, the control exists on paper only.

A handful of niche credentials, such as CTPRP and CTPRA, were built specifically to answer this gap for vendor risk assessors. As one breakdown of the field puts it, these certifications validate a professional's ability to assess vendor risk, conduct due diligence, manage third-party controls, monitor supplier performance, and support remediation across the vendor lifecycle. They're useful, narrow tools. But most regulated buyers aren't only checking whether a vendor has a TPRM specialist on staff. They're checking whether the broader team touching their data, systems, and risk decisions holds credentials that map to recognized enterprise risk frameworks.

Which Certification Actually Answers This Question for a Vendor Team?

For a team that has to prove it can identify, assess, and respond to IT risk across an enterprise relationship, not just complete a questionnaire once a year, ISACA's CRISC credential is the closest direct match. It's built around the exact activities regulators are asking vendors to demonstrate: risk identification, risk assessment, risk response, and control monitoring, applied at the level of an organization's full risk environment rather than a single audit checklist. A vendor that can point to CRISC-certified staff sitting in the roles responsible for ongoing monitoring and control ownership is answering the regulator's staffing question with evidence instead of assurance language.

That matters more as the review cycle becomes continuous rather than annual. The newer vendor risk guidance from supply-chain and TPRM practitioners increasingly frames point-in-time attestation as insufficient on its own, pushing toward the same continuous-monitoring posture DORA and the federal banking guidance both already require. Drata's current vendor assessment guidance maps this directly to control frameworks buyers already know, noting that SOC 2's CC9.2 criterion and ISO 27001's Annex A.5.19 through A.5.23 both require documented, operating supplier relationship controls, not just a signed attestation that controls exist. Staff credentials are what make "operating" provable between audits.

If you sit on either side of this relationship, as the buyer running due diligence or the vendor trying to pass it, the practical move is the same: stop treating staff certification as a resume line and start treating it as a control you can document. A good internal resources hub that maps certifications to specific risk and compliance roles makes that documentation far easier to produce on demand, instead of scrambling when a questionnaire asks for it.

What This Means for the People Doing the Work

None of this changes because a vendor's logo is recognizable or its contract is large. Regulators have been explicit that staffing qualifications get evaluated regardless of vendor size, and the newest proposed guidance leans toward more scrutiny for higher-risk relationships, not less. If your team handles vendor risk assessments, contract renewals, or ongoing monitoring for a regulated client, the certification sitting next to your name is no longer a career nicety. It's the evidence a buyer's compliance officer is specifically instructed to ask for.

For security and IT staff who want that evidence to hold up under an examiner's or auditor's questions, building toward the CRISC certification is a direct response to what the guidance above actually asks for, not a generic resume boost. If you want a study plan built around the risk identification, assessment, and monitoring domains examiners expect to see reflected in staffing, you can start training whenever you're ready. The next vendor questionnaire that lands on your desk will likely ask for a name and a credential number. Better to have both ready than to explain their absence afterward.

Start training free at Forge University