Choosing categories
Beyond Security: which categories to add, and when to wait.
Every SOC 2 includes Security, the common criteria. The other four categories are optional, and each one adds controls you must run and evidence across the whole period. Add one when a commitment you have already made points to it, not because a fuller list looks better.
Back to SOC 2 services01 · Start from commitments
Start from what you have promised
Categories follow your service commitments, not your ambitions.
The description criteria ask management to state its principal service commitments and system requirements: the promises made to customers in contracts, SLAs and published terms. The categories you choose should be the ones that test whether those promises are kept. If you have promised uptime, Availability is relevant. If you have promised nothing about personal data handling beyond security, Privacy probably is not.
Gather these before deciding
- Master services agreement
- SLA and uptime terms
- Data processing agreement
- Privacy notice
- Recent buyer questionnaires
- Security addenda
- Product data flows
What a CPA firm may ask at planning
- Which commitments in your contracts relate to uptime, confidentiality, accuracy or personal data?
- Are those commitments the same for every customer, or negotiated one by one?
- Which categories did buyers ask for in the last few security reviews?
- If a category is left out, does the description still give a fair picture of what customers rely on?
02 · Triggers
Triggers for each optional category
What, in your paperwork, should prompt each one.
| Category | Typical triggers | Usually not a trigger |
|---|---|---|
| Availability | A contractual uptime SLA with credits; customers running operations on your service; buyer questions about recovery objectives | A best-efforts status page with no commitment |
| Confidentiality | Contracts that name customer data as confidential; NDAs covering business information you process; retention and destruction clauses | Holding only your own internal documents |
| Processing Integrity | You calculate, transform or move values customers rely on: payments, payroll, billing, claims, reports | You store files without changing them |
| Privacy | You collect personal information directly from individuals and make notice and choice commitments to them | You process personal data only on a business customer's instructions, with no direct relationship to individuals |
Illustrative guidance. The final call belongs to management, with input from the CPA firm during planning.
03 · What each adds
What each category adds to run and evidence
Scope creep is paid in controls, owners and period evidence.
- Availability (A1.1–A1.3)Capacity monitoring, environmental protections, backup, and a recovery test the auditor can inspect.
- Confidentiality (C1.1–C1.2)Identifying confidential information, protecting it, and disposing of it on schedule, with records of disposal.
- Processing Integrity (PI1.1–PI1.5)Defined processing specifications, input and output checks, error handling and reconciliations across the period.
- Privacy (P1–P8)Notice, choice and consent, collection limits, use and retention, data subject access, disclosure, quality and complaint monitoring.
Each added category also lengthens the system description and the auditor's test plan. A category added in a hurry often shows up as exceptions in the first Type 2.
A useful test before adding a category
Name the owner for each new criterion, the evidence it will produce every month or quarter, and the contract clause it answers. If any of the three is blank, the category is not ready for this period.
04 · Decision table
A quick decision table
Illustrative profiles.
| Illustrative company | Security | Availability | Confidentiality | Processing Integrity | Privacy |
|---|---|---|---|---|---|
| Developer tool, no uptime SLA | Yes | Wait | Consider | No | No |
| B2B SaaS with a 99.9% uptime SLA | Yes | Add | Consider | No | No |
| Payroll platform for employers | Yes | Consider | Add | Add | Consider |
| Consumer health app with direct sign-ups | Yes | Consider | Consider | No | Add |
| Data room for legal deals | Yes | Consider | Add | No | No |
05 · Mistakes
Common choosing mistakes
More categories is not more trust.
- Adding Privacy to look complete. Privacy brings eight criteria groups with heavy period evidence. Without real privacy commitments, it creates exceptions, not trust.
- Promising an SLA but leaving out Availability. Buyers who negotiated uptime notice its absence.
- Adding Processing Integrity for a storage product. If you do not transform data, the criteria have little to test.
- Copying a competitor's categories. Their contracts are not yours.
- Adding all four in year one. Starting with Security plus the one or two categories your contracts demand is easier to sustain; add the rest in later periods.
Sources: AICPA Trust Services Criteria TSP section 100 (2017, revised points of focus 2022); AICPA description criteria DC section 200 (principal service commitments and system requirements); AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization.
Questions about picking categories
Can we add a category in year two without starting over?
Yes.
The next period simply includes it. Build and run its controls before that period starts, so evidence exists for the whole window.
A buyer's questionnaire asks about all five. Must we include all five?
Not necessarily.
Answer the questionnaire directly where you can and include only the categories your commitments support. Explain the choice; most reviewers accept a reasoned scope.
If we drop a category later, does that look bad?
It needs a reason.
Removing a category readers relied on raises questions. Disclose the change and make sure your contracts no longer promise what it tested.
Is Security alone a lesser report?
No.
Security, the common criteria, is the core of every SOC 2 and the most widely requested scope. Extra categories answer extra promises.
Scope to your promises.
We read your contracts and data flows with you and recommend the categories they actually call for.