SOC 2 compliance › Trust Services Criteria
SOC 2 criteriaSOC 2 Trust Services Criteria: which ones to include
Every guide defines the five criteria. This one helps you decide: which are required, which to add, and what the Security category asks of you in practice.
Free for buyers · provider-funded introductions · Updated October 2026
At a glance
ForTeams scoping a first SOC 2 report
CoversThe five categories, how to choose and CC1 to CC9
You end withA shortlist of criteria to confirm with your auditor
It is notThe criteria text. Read the AICPA source with your auditor
The short answer
What are the SOC 2 Trust Services Criteria?
The Trust Services Criteria are the AICPA criteria a CPA firm uses to evaluate your controls in a SOC 2 examination. There are five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is required in every report and the other four are optional, so scope depends on what your customers and contracts need.
- Security is always in scope and is made up of the Common Criteria, CC1 to CC9.
- Add an optional category only when a customer, contract or the nature of your service calls for it.
- The criteria state outcomes. You design the controls and your auditor tests them.
The five categories
One required category, four optional
Security is the core. The others are added to match what you promise customers.
| Category | Code | What it addresses | Typically added when |
|---|---|---|---|
| Security | CC | Protecting information and systems against unauthorised access, disclosure and damage. | Always included. |
| Availability | A | Whether the system is available for operation and use as committed. | Contracts or SLAs promise uptime, capacity or recovery. |
| Processing Integrity | PI | Whether processing is complete, valid, accurate, timely and authorised. | Customers rely on your calculations, transactions or reports. |
| Confidentiality | C | Protecting information designated as confidential. | You hold customer data under NDA or promise deletion. |
| Privacy | P | How personal information is collected, used, retained, disclosed and disposed of. | You handle personal information about individuals. |
Source: AICPA, 2017 Trust Services Criteria (With Revised Points of Focus – 2022). This page is a plain-language summary, not the criteria text.
How to choose
Decide by what customers and contracts ask for
Match the signals you already see to a category. Then confirm the shortlist with your auditor.
| If you see this | Consider | Why |
|---|---|---|
| A contract or SLA promises uptime, capacity or recovery times | Availability | The auditor will test that you monitor and meet what you committed to. |
| Customer data is held under NDA, or customers expect deletion on request | Confidentiality | It covers protecting designated confidential information through its life. |
| Customers rely on figures you calculate, process or report | Processing Integrity | It tests whether processing is complete, accurate, timely and authorised. |
| You collect or store personal information about individuals | Privacy | It evaluates handling of personal information against your stated commitments. |
| A questionnaire only says “SOC 2” with no detail | Security alone, for now | Ask the customer which criteria they expect before adding scope. |
Privacy is not a substitute for meeting privacy laws that apply to you. Those need separate assessment.
Inside Security
What the Common Criteria, CC1 to CC9, cover
Security is not just technical controls. CC1 to CC5 cover governance and oversight, so plan for policies and accountability as well as tooling.
| Group | Name | What auditors look at | Related readiness area |
|---|---|---|---|
| CC1 | Control environment | Oversight, structure, competence and accountability | Governance and policies; People and training |
| CC2 | Communication and information | How responsibilities and information are communicated inside and outside the organisation | People and training; Governance and policies |
| CC3 | Risk assessment | Identifying, analysing and responding to risk, including fraud risk | Risk assessment |
| CC4 | Monitoring activities | Evaluating whether controls work and fixing deficiencies | Logging and monitoring; Governance and policies |
| CC5 | Control activities | Selecting and deploying controls and policies, including technology controls | Governance and policies |
| CC6 | Logical and physical access | Who can reach systems and data, how they authenticate, physical access and data disposal | Access control; Data protection |
| CC7 | System operations | Detecting vulnerabilities and anomalies, monitoring, responding to incidents and recovering | Vulnerability management; Logging and monitoring; Incident response |
| CC8 | Change management | Authorising, testing and approving changes | Change management |
| CC9 | Risk mitigation | Business-disruption planning and vendor risk | Continuity and recovery; Vendor management |
The last column is our approximate mapping to the 11 areas in the SOC 2 readiness checklist. One area often touches several groups.
Scope
Scope decisions that change the work
- Start narrow. Each extra category adds controls, evidence and audit effort.
- Confirm the shortlist with your auditor before you commit, including how and from when an added category can be covered.
- Customers read a report to see which criteria it covers, so changing scope between reports may prompt questions.
- Choose report type separately. See SOC 2 Type 1 vs Type 2.
Common mistakes
Mistakes teams make when picking criteria
- Adding Privacy or Confidentiality “to be safe” with no customer asking for it.
- Treating the criteria as a control list instead of designing controls that meet the outcomes.
- Underestimating CC1 to CC5, which are about governance and evidence, not only tools.
- Assuming Privacy means compliance with privacy law.
FAQ
Trust Services Criteria questions
What are the SOC 2 Trust Services Criteria?
They are the criteria an auditor uses to evaluate your controls in a SOC 2 examination. They are published by the AICPA and grouped into five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy.
Which Trust Services Criteria are mandatory?
Security is the only one required in every SOC 2 report. Availability, Processing Integrity, Confidentiality and Privacy are optional and are added when your service, your customers or your contracts call for them.
How do I choose which criteria to include?
Start from what customers and contracts ask for. An uptime commitment points to Availability, data held under NDA to Confidentiality, customer-relied calculations to Processing Integrity, and personal information to Privacy. If a questionnaire only says SOC 2, ask the customer which criteria they expect.
Does the SOC 2 Privacy criterion mean we comply with privacy law?
No. The Privacy criterion evaluates how you handle personal information against the commitments you make. It is not a substitute for meeting the privacy laws that apply to you, which need separate assessment.
Are the criteria a list of controls I must implement?
No. The criteria describe outcomes. You design the controls that meet them, and the auditor tests whether those controls are suitably designed and, for a Type 2 report, operated effectively.
Can I add a criterion later?
Usually yes, but each one adds controls and evidence. Ask your auditor how and from when an added criterion can be covered by the report. Adding criteria before anyone asks for them adds effort without a requirement.
Start here
Start with the requirement, not the auditor.
Requirement→Scope→Price→Matched provider
Tell Us What You NeedFree for buyers · provider-funded introductions