What are CUECs in a SOC report?

CUECs are complementary user entity controls. They are controls the service organization's customers must have in place for the service organization's controls to achieve the stated objectives or criteria.

For example, a payroll service organization might control payroll processing inside its platform, but the customer may still need to approve employee master-file changes and review payroll reports. The SOC report can identify those customer-side controls so users understand where control responsibility shifts back to the user entity.