Term

Trust Services Criteria

The five criteria SOC 2 reports are scoped against.

The AICPA's Trust Services Criteria are Security, Availability, Processing Integrity, Confidentiality, and Privacy. Every SOC 2 report covers Security at minimum; the other four are optional.

Trust Services Criteria, explained

The Trust Services Criteria are often summarized as five boxes to tick, but the structure underneath is more detailed than that. The five are more precisely called categories. Each category contains numbered criteria, and each criterion comes with points of focus that describe what a well-designed control would typically address. A SOC 2 auditor evaluates your controls against the criteria, not against a fixed control list.

The categories and their criteria

Category, Criteria reference, What it asks comparison
Category	Criteria reference	What it asks
Security	CC1 to CC9 (the Common Criteria)	Is the system protected against unauthorized access, use, or modification?
Availability	A1 series	Is the system available for operation and use as committed or agreed?
Processing Integrity	PI1 series	Is system processing complete, valid, accurate, timely, and authorized?
Confidentiality	C1 series	Is information designated as confidential protected as committed or agreed?
Privacy	P1 to P8	Is personal information collected, used, retained, disclosed, and disposed of in line with commitments?

Inside the Common Criteria

Security is mandatory because its criteria, known as the Common Criteria, form the foundation every other category builds on. They are grouped into nine series. The first five follow the components of the COSO 2013 Internal Control framework, which is why SOC 2 feels familiar to anyone with a financial controls background.

Series, Topic, Typical controls comparison
Series	Topic	Typical controls
CC1	Control environment	Code of conduct, background checks, board or management oversight
CC2	Communication and information	Policies published to staff, system descriptions, customer commitments
CC3	Risk assessment	Annual risk assessment, fraud risk consideration, change impact analysis
CC4	Monitoring activities	Internal audits, control self-assessments, remediation tracking
CC5	Control activities	Selecting and documenting controls, policies that put them into action
CC6	Logical and physical access	MFA, access reviews, encryption, offboarding, endpoint protection
CC7	System operations	Vulnerability scanning, logging and alerting, incident response
CC8	Change management	Code review, change approval, testing before deployment
CC9	Risk mitigation	Business continuity, insurance, vendor and business partner risk

Points of focus are guidance, not requirements

Each criterion lists points of focus, for example specific considerations under CC6.1 about restricting logical access. They help both you and the auditor judge whether a control addresses the criterion, but not every point of focus must be addressed, and an organization can meet a criterion in ways the points of focus do not mention. What matters is that your controls credibly satisfy the criterion for your system.

Choosing which categories to include

Availability: include if customers depend on uptime commitments or you publish an SLA.
Confidentiality: include if you handle customer information designated as confidential, such as business plans, source code, or financial data.
Processing Integrity: include if customers rely on the accuracy of your processing, such as payments, payroll, or data transformation.
Privacy: include if you collect personal information directly from individuals and make privacy commitments to them. Service providers that only process personal data on behalf of business customers often address it through Confidentiality instead.

FAQ

Frequently asked questions

Are the Trust Services Criteria the same as SOC 2?

No. The Trust Services Criteria are the evaluation criteria published by the AICPA. SOC 2 is the type of examination and report that uses them. The same criteria are also used in other engagements, such as SOC 3 reports and SOC for Cybersecurity, so the criteria exist independently of any single report type.

Is Security always required in a SOC 2 report?

Yes. Every SOC 2 examination includes the Security category, because its Common Criteria underpin the others. Availability, Processing Integrity, Confidentiality, and Privacy are optional and added based on the services you provide and the commitments you make to customers.

Which version of the Trust Services Criteria is current?

The criteria in use are the 2017 Trust Services Criteria, which the AICPA supplemented with revised points of focus in 2022. The criteria themselves were not rewritten in that update; the changes clarified and expanded the guidance. Confirm with your audit firm which version applies to your examination period.

How do the Trust Services Criteria relate to COSO?

The Common Criteria CC1 to CC5 are aligned with the 17 principles of the COSO 2013 Internal Control Integrated Framework, covering control environment, communication, risk assessment, monitoring, and control activities. The remaining series, CC6 to CC9, add criteria specific to technology and security operations.

Keep exploring

Trust Services Criteria

Related