Track every obligation you take on when you engage a third party.
Make commitments visible.
The team knows what needs evidence next.
When you engage a third party, you take on duties too: the complementary user entity controls (CUECs) in their SOC 2, the obligations in the contract, the tasks in the SOW. They're buried in PDFs, and no one owns them until something breaks.
Obligations Tracker extracts the obligations you're responsible for and turns them into owned, scheduled, tracked tasks. CUECs from SOC 2 reports, legal terms from contracts, SOW duties, and the technical controls you have to maintain are all assigned and monitored, so your side of the relationship holds up as well as theirs.
The obligations you own, in one place.
- 01
CUECs from SOC 2 reports
Capture the complementary user entity controls a vendor's SOC 2 says are your responsibility.
- Assign and track each one instead of assuming it's handled.
- 02
Contract and legal obligations
Pull the duties your organization owns from contracts and turn them into tracked, owned commitments.
- 03
SOW duties
Track the tasks and deliverables you're responsible for in statements of work.
- 04
Technical controls
Keep the technical controls you must maintain assigned, scheduled, and evidenced.
Hold up your side of every relationship.
Your side, covered
The duties you take on are owned, not assumed.
CUECs handled
No more SOC 2 user controls quietly ignored.
Reminders before each due date
Owners get reminders before each obligation is due.
Audit-ready
Show that you met your obligations, with evidence.
One view
Every obligation across every relationship in one place.
“We always reviewed vendors' SOC 2s. We never tracked the controls they said were our job. Now we do.”
CUECs tracked
Pulled from every SOC 2.
Obligations owned
Assigned, not assumed.
Reminders on schedule
Owners hear before each due date.
Audit-ready
Evidence on demand.
Who owns each duty.
The work a supplier document assigns to your team.
What is a CUEC?
It is a complementary user entity control, a duty your organization performs so a supplier’s SOC 2 control environment works as described.
Which obligations do you track?
We find CUECs in SOC 2 reports, contract and legal duties, statement-of-work tasks, and technical controls.
Can we assign owners and due dates?
Yes. We put an owner, schedule, reminder, and completion evidence against the obligation.
Do you also track what the supplier owes us?
Contract Guardian reads the supplier agreement and its terms. Here we focus on the work your own team must perform.