Glossary · SOC and attestation
The Trust Services Criteria set the yardstick every SOC 2 is measured against.
The AICPA's published set of criteria, grouped into five categories, against which a service organization's controls are evaluated in SOC 2 and SOC 3 examinations.
Back to the glossary01 · In plain words
In plain words
The AICPA's published set of criteria, grouped into five categories, against which a service organization's controls are evaluated in SOC 2 and SOC 3 examinations.
A CPA firm cannot give an opinion without something to measure against. For SOC 2 and SOC 3, that benchmark is the Trust Services Criteria. They describe outcomes a well-controlled system achieves, and you design your own controls to meet them.
Spelled out: AICPA Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
The criteria decide what your report says and what a buyer can rely on. Security, built from the common criteria CC1 to CC9, is in every SOC 2. Privacy, Confidentiality, Processing Integrity and Availability are optional extras, taken on when they suit your service and your customers' needs. Adding a category means more controls and more testing; leaving out one a buyer cares about means a report that does not answer their question.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The scope section of an engagement letter
- Lists which categories the examination will cover.
- The testing section (Section 4) of a Type 2 report
- Each criterion is listed beside your controls and the examiner's tests.
- A control matrix
- Your internal map of every control to the criteria it supports.
- A SOC 3 report
- States which categories were examined in a short public form.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: an HR-tech startup is asked for "availability"
A Noida payroll startup plans a Security-only SOC 2. An enterprise prospect then asks whether the report covers Availability, because payroll that fails on salary day is a business risk for them. The team reviews what Availability would add: capacity monitoring, recovery plans and tested restores. They already run most of it, so they add the category. They leave Privacy out, since their customers act as the controllers of employee data and their contract handles that.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Points of focus
- Illustrative characteristics listed under each criterion. They guide design but are not each required.
- Controls
- The criteria state the goal. Controls are the specific things your company does to meet it.
- ISO 27001 Annex A
- A catalogue of controls for an ISMS. The criteria are outcome statements for an attestation, written by a different body.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- Start with Security, then add a category only when a customer need or a contract justifies it.
- Map each of your controls to the criteria it supports before the examiner does.
- Read the points of focus as prompts, and note where one does not apply to you.
- GuideTrust Services CriteriaThe five categories, with CC1 to CC9 read as questions your controls answer.
- GuideTSP 100: how the criteria document is builtCategories, criteria and points of focus, and why the 2017 set still applies.
- GuidePicking categories beyond SecurityWhich of the five categories your customers actually need.
Sources: AICPA TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022).
Questions about Trust Services Criteria
Do we have to cover all five categories?
No. Only Security is required.
Security is part of every SOC 2. The other four are optional and chosen to fit the service and what customers rely on it for.
Who publishes the criteria?
The AICPA.
The AICPA's Assurance Services Executive Committee publishes the Trust Services Criteria and revises the points of focus from time to time.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.