SOC2 Update SOC 2 Carve-Out vs Inclusive Method: How Subservice Providers Appear in Your Report SOC 2 carve-out vs inclusive method: how subservice providers such as AWS appear in your report, what CSOCs are and what auditors expect. October 15, 2026