SOC2 Vendor SOC2 Report Freshness Tracker

Keeps your third-party / subprocessor risk management control (CC9.2) continuously current. It checks the validity window of each vendor's most recent SOC2 (or equivalent) report and turns stale entries into an actionable review queue.

Run it monthly. SOC2 reports lapse on a rolling basis, and auditors increasingly ask for evidence that you actively re-review vendors rather than collecting reports once and forgetting them.

1. 1A scheduled trigger fires monthly.
2. 2The flow reads every vendor row from the Airtable subprocessor register, including report date and validity period.
3. 3A logic step buckets each vendor into current, expiring within 60 days, or expired, and ranks by data-sensitivity tier.
4. 4It updates a living vendor-risk summary page in Confluence with the current status table.
5. 5It posts the expiring and expired vendors to Slack so the owner can request fresh reports before the gap opens.