SOC 2 bridge letter: covering the gap your report does not
A bridge letter is management’s own assertion, not the auditor’s. It closes a few months of calendar and nothing more — and customers who understand that read it accordingly.
A contracting officer scans it for identifiers and past performance. Design-led capability statements that hide the codes get filed and forgotten.
A capability statement is the one-page document a contractor sends to a government buyer to introduce itself. It is the standard artefact of federal business development, requested by name, and it has a conventional structure that its readers expect — which makes it one of the few marketing documents where following the convention beats standing out.
The reason is how it is used. A contracting officer or small business specialist receives many of these, scans for whether the company can do the work and whether it is registered and eligible, and files it against a category. A statement that buries the identifiers under a designed layout does not fail because it is ugly; it fails because the reader could not extract the two facts they needed in fifteen seconds.
A single generic statement is worth having and worth tailoring. Reordering competencies to lead with what a particular agency buys, and swapping in the past performance most similar to their work, takes ten minutes and materially changes how the document reads. The version sent to a defence logistics office and the one sent to a civilian IT directorate should not be identical, even though the corporate data block is.
Keep it to one page. Two pages is a brochure, and a brochure does not get filed in the category the sender wanted. If the content genuinely will not fit, the competencies section is too broad — narrow the claim rather than adding a page.
New contractors have the least of it and treat the section apologetically, which is the wrong instinct. List commercial work with the scope stated in terms the buyer recognises, name subcontract roles honestly, and describe the outcome rather than the activity. What must not appear is vagueness — unnamed clients, unquantified scope, or claims of experience that a reference check would not support, since the whole purpose of the section is to be checkable.
Because it is tailored per agency and updated whenever certifications or performance change, the failure mode is an outdated version circulating with expired identifiers. Ettex Docs holds the statement with version history and the tailored variants, Ettex Records keeps the corporate data that feeds it — identifiers, certifications, vehicles — with their expiry dates, and the registration those identifiers come from is covered in sam registration.
Plainly: this is documents and records, not a proposal service. What wins federal work is past performance and pricing; the capability statement’s job is narrower — to get you into the right file when somebody is looking for a firm like yours.
A one-page document introducing a contractor to a government buyer, covering core competencies, differentiators, past performance, corporate data and contact details.
One page. Longer versions read as brochures and are less likely to be filed usefully.
Unique entity identifier, CAGE code, industry codes, socio-economic certifications and any contract vehicles held.
Yes. Reorder competencies and swap past performance to match the agency being approached; the corporate data block stays constant.
A bridge letter is management’s own assertion, not the auditor’s. It closes a few months of calendar and nothing more — and customers who understand that read it accordingly.
The rebuttal letter is a cover sheet, not an essay. Its job is to point at each attachment and say which requirement it satisfies.
Rejecting a candidate because of a background check is a two-letter process with a waiting period in between. Sending only the second letter is the most common FCRA mistake.