Glossary: Compliance, Privacy and Penetration Testing

Complementary user entity controls

Also written: customer responsibilities

Controls that a SOC 2 report says the customer must run itself, such as turning on multifactor authentication. If Kettle & Crane skips them, the provider's clean report doesn't protect it.