Organizations should request the SOC report during contracting and vendor selection. If it is a critical vendor, then make sure to ask for different types of reports before onboarding them.