The rulebook behind SOC
The AICPA attestation standards, on one page.
Every SOC report rests on two kinds of document. Attestation standards tell the CPA firm how to do the work. Criteria tell everyone what the subject is measured against. This page maps the first kind, shows which SOC report uses which section, and places the criteria beside them.
Back to SOC 2 services01 · Three layers
Standards, criteria and guides are different things
One governs the examiner, one is the yardstick, one is practical help.
People say “SOC 2 is SSAE 18” or “SOC 2 is the Trust Services Criteria”. Both are half right. A SOC 2 examination is performed under the attestation standards, against the criteria, with the AICPA's SOC 2 guide as interpretive help. Mixing the layers up is how a vendor ends up claiming a “SSAE 18 certificate”, which does not exist.
- 1Attestation standardsSSAE 18, as amended, codified as the AT-C sections. Binding on the CPA firm: acceptance, evidence, independence, reporting.
- 2CriteriaThe benchmark the subject is judged against: TSP section 100 for controls, DC section 200 for the SOC 2 description, management's own control objectives in a SOC 1.
- 3AICPA guidesThe SOC 1 and SOC 2 guides explain how the standards apply to each engagement, with illustrative reports.
The standards are written by the AICPA's Auditing Standards Board (ASB). The Trust Services Criteria and the description criteria come from the AICPA's Assurance Services Executive Committee (ASEC). Two different bodies, two different kinds of document.
02 · AT-C sections
The AT-C sections and where you meet them
Grouped in three divisions: common concepts (100), level of service (200), subject matter (300).
| Section | What it governs | Where a SOC 2 company meets it |
|---|---|---|
| AT-C 105 | Concepts common to all attestation engagements: parties, criteria, independence, acceptance | Every SOC engagement, from the engagement letter onward |
| AT-C 205 | Assertion-based examination engagements: reasonable assurance, an opinion | The core of your SOC 2 and SOC 3 examination |
| AT-C 206 | Direct examination engagements, added by SSAE 21: no assertion from the responsible party | Rarely, if ever, in SOC reporting today |
| AT-C 210 | Review engagements: limited assurance, a conclusion rather than an opinion | Not used for a SOC 2 report |
| AT-C 215 | Agreed-upon procedures: findings only, no opinion | Occasionally for narrow, customer-specified checks |
| AT-C 305 | Prospective financial information | Not in SOC work |
| AT-C 310 | Reporting on pro forma financial information | Not in SOC work |
| AT-C 315 | Compliance attestation | Not in SOC work, though the idea of an assertion about compliance is similar |
| AT-C 320 | Examination of controls at a service organization relevant to user entities' internal control over financial reporting | Your SOC 1, if you have one |
| AT-C 395 | Designated for the older section on Management's Discussion and Analysis | Not in SOC work |
There is no SOC 2 section
Only SOC 1 has its own subject-matter section (AT-C 320). A SOC 2 runs on the common concepts section and the examination section, and takes its subject-matter detail from the AICPA SOC 2 guide and the two criteria documents.
03 · SOC suite
Which SOC report runs on which standard
Same examination machinery; different criteria and different readers.
| Report | Standards | Criteria | Who may read it |
|---|---|---|---|
| SOC 1 | AT-C 105, 205, 320 | Control objectives defined by management; description requirements inside AT-C 320 | Management, user entities and their auditors |
| SOC 2 | AT-C 105, 205 | TSP 100 for controls, DC 200 for the description | Restricted to informed parties named in the report |
| SOC 3 | AT-C 105, 205 | TSP 100 | General use |
| SOC for Cybersecurity | AT-C 105, 205 | Description criteria for a cybersecurity risk management program; control criteria such as TSP 100 | General use, about the whole entity's program |
| SOC for Supply Chain | AT-C 105, 205 | Supply chain description criteria and TSP 100 | Customers and business partners in the chain |
04 · Where criteria sit
Where TSP 100 and DC 200 sit relative to the standards
The standards demand suitable, available criteria. TSP 100 and DC 200 are the criteria that satisfy that demand for SOC 2.
Attestation standards
How the work is done
- Written for the CPA firm
- Require independence, evidence and skepticism
- Set the form of the opinion
- Do not say what a good control is
Criteria
What the subject is measured against
- Used by management and the CPA alike
- TSP 100: are the controls suitably designed and effective?
- DC 200: is the description fair?
- Say nothing about how to collect evidence
AT-C 105 makes suitable criteria a precondition of any engagement. The AICPA's own criteria are treated as suitable when the engagement uses them as intended, which is why SOC 2 needs no debate about its yardstick.
So the opinion in Section 1 of a SOC 2 report names both layers: it says the examination followed the AICPA's attestation standards, and that the description and controls were evaluated against the description criteria and the trust services criteria. If a report names neither, ask why.
05 · Reading the citations
What to check when a report cites the standards
Three citations in the opinion tell you whether the report is current and real.
- The standards. Attestation standards established by the AICPA. A SOC 2 citing SSAE 16 or SAS 70 is out of date.
- The description criteria. For SOC 2, DC 200 (the 2018 description criteria). A SOC 1 cites its own control objectives instead.
- The control criteria. The 2017 Trust Services Criteria, usually with the revised points of focus. Older “principles” language signals an outdated report.
- The firm. A licensed CPA firm, independent of the company. The standards bind only CPAs.
06 · What changes
The standards keep moving
SSAE 18 is still the base, as amended by later statements.
- SSAE 19 replaced the agreed-upon procedures section (AT-C 215).
- SSAE 20 updated the description of materiality in AT-C 205 and 210.
- SSAE 21 added direct examinations (AT-C 206) and revised the assertion-based examination section.
- SSAE 22 replaced the review section (AT-C 210).
- SSAE 23 brought the standards in line with the AICPA's quality management suite. It applies to engagements that start from 15 December 2025.
- In 2026 the ASB exposed a broader revision of AT-C 105, 205 and 210, plus new sustainability sections. If issued as final, the proposed start date is 15 June 2029 for engagements from that day on.
Sources: AICPA SSAE No. 18, Attestation Standards: Clarification and Recodification, as amended; AICPA SSAE Nos. 19 to 23; AICPA Professional Standards, AT-C sections index; AICPA SOC suite of services and SOC 2 guide pages; Journal of Accountancy reporting on SSAE 18 (2016), SSAE 23 (2024) and the 2026 exposure drafts.
Questions about the standards map
Is SOC 2 a standard in its own right?
No. It is a type of examination under the AT-C sections.
“SOC 2” names an engagement and a report. The work is governed by AT-C 105 and 205, the yardsticks are TSP 100 and DC 200, and the AICPA SOC 2 guide explains how they fit together.
Why do some reports mention SSAE 18 and others don't?
Wording varies; the substance is the same.
Many opinions simply refer to “attestation standards established by the AICPA”. That phrase covers SSAE 18 as amended. What matters is that the standards are the current AICPA ones and the criteria are named.
Does a founder need to read the AT-C sections?
Rarely. Knowing the map is enough.
The standards bind the CPA firm, not you. Knowing which section governs which step helps you understand why the auditor asks for an assertion, representations or a complete population.
Can a non-CPA firm perform an engagement under these standards?
No.
The AT-C sections are standards for CPA practitioners. A readiness adviser can help you prepare; only a licensed CPA firm can perform and report on the examination.
Know which rulebook your report runs on.
We walk your team through the standards and criteria your SOC 2 will be examined under before the CPA firm arrives.