We recommend that the Department develop a process to review new and existing contracts with service organizations to require the service organizations to provide appropriate SOC 1, Type 2, reports and bridge letters. Such review should include assessing the relevancy to Department’s controls to be tested in the SOC 1 report, the period covered, and understanding of complementary user controls to be performed by the Department.