Trust Services Criteria
Every criterion is a question. Your controls are the answers.
A SOC 2 auditor never hands you a control list. They hold up the Trust Services Criteria published by the AICPA and ask whether your system satisfies each one. Read the criteria as questions and the work gets clearer: you decide how to answer, the auditor decides whether the answer holds. This page walks the questions series by series and shows which ones your contracts switch on.
Back to SOC 2 services01 · Criterion to test
From a criterion to an auditor's test, in four steps
A criterion states a result. Everything between that result and a tested control is your design.
- The criterion. One sentence in TSP 100 saying what the entity achieves, for example that logical access to protected assets is restricted.
- The points of focus. Hints from the AICPA about what that result usually involves. They help you think; skipping one is not an automatic failure.
- Your control. A specific activity you run, with an owner and a frequency, such as a quarterly review of production access signed off by the engineering lead.
- The test. The auditor inspects, observes, re-performs or samples that control. In a Type 2 they look at how it ran across the whole period.
The criteria date from 2017. In 2022 the AICPA updated the points of focus, not the criteria themselves, so a 2017 mapping still lines up criterion for criterion. Because step three belongs to you, two companies can answer the same question in very different ways and both satisfy the auditor.
02 · CC1 to CC5
CC1 to CC5: questions about how the company is run
The first five series borrow the COSO 2013 internal control framework. They test leadership and habits, not servers.
| Series | The question behind it | Criteria | Evidence that usually answers it |
|---|---|---|---|
| CC1 Control environment | Does leadership set standards for conduct and hold people to them? | 5 | Code of conduct sign-offs, an org chart, background checks, board or founder oversight minutes |
| CC2 Communication and information | Do the right people get the security information they need, inside and outside? | 3 | Policies people can find, a published security contact, customer-facing commitments |
| CC3 Risk assessment | Do you look for what could go wrong, including fraud and change? | 4 | A dated risk register with owners and treatment decisions |
| CC4 Monitoring activities | Do you check that controls still work and fix the gaps? | 2 | Internal reviews, tracked remediation tickets |
| CC5 Control activities | Did you pick controls for the risks and write them into policy? | 3 | A control matrix tied to the risk register, approved policies |
Early-stage teams tend to under-prepare here. A five-person company still needs a written risk assessment and a visible person accountable for security; the auditor scales expectations to size but does not drop the question.
03 · CC6 to CC9
CC6 to CC9: questions about the system itself
These four series are where engineering effort lands, and CC6 alone holds eight criteria.
| Series | The question behind it | Criteria | Evidence that usually answers it |
|---|---|---|---|
| CC6 Logical and physical access | Can only the right people and systems reach your data, and are leavers cut off? | 8 | Joiner and leaver tickets, MFA settings, access reviews, encryption configuration, endpoint protection |
| CC7 System operations | Would you notice an attack or fault, and would you respond well? | 5 | Vulnerability scans, alerting rules, incident records, post-incident reviews |
| CC8 Change management | Is every change to production authorised, tested and traceable? | 1 | Pull requests with approvals, deployment logs, emergency-change records |
| CC9 Risk mitigation | Are you ready for disruption, and do you watch your vendors? | 2 | Business continuity plans, insurance decisions, vendor reviews |
- Common criteria
- 33
- CC1 to CC9, present in every SOC 2
- Availability
- 3
- A1.1 to A1.3
- Confidentiality
- 2
- C1.1 and C1.2
- Processing Integrity
- 5
- PI1.1 to PI1.5
- Privacy
- 18
- Spread across eight series, P1 to P8
04 · When to add more
The four optional categories, and the promise that switches each on
Look for the sentence in a contract that would make a customer feel misled if you had no control behind it.
- Availability (A1)Switched on by an uptime figure in an SLA or a status-page promise. The questions cover capacity, environmental threats to the infrastructure, and whether backups and recovery are tested, not just configured.
- Confidentiality (C1)Switched on by contract clauses about protecting information a customer marks as confidential. The two criteria ask how you identify that information and how you destroy it when the retention period ends.
- Processing Integrity (PI1)Switched on when customers depend on your outputs being right: payroll runs, billing, payment files, data pipelines. Expect questions on input checks, error handling and reconciliations.
- Privacy (P1 to P8)Switched on by a privacy notice you give to the people whose data you hold. It is the widest category, reaching notice, consent, collection, use, retention, disposal, access requests, disclosure, data quality and complaint handling.
Illustrative: a payroll SaaS picking categories
A company runs payroll for mid-sized employers. Its master agreement promises 99.9 percent uptime and accurate pay calculations, and treats payroll files as confidential. Its privacy notice is addressed to employers, not to employees. A sensible scope is Security, Availability, Processing Integrity and Confidentiality. Privacy stays out for now, because the company makes no direct promises to the individual employees.
05 · Mis-picks
Category choices that cause trouble later
Each extra category is a set of questions you must answer again in every future period.
- Adding Privacy because you hold personal data. Holding personal data is a Security and Confidentiality matter. Privacy fits when you make direct commitments to individuals; it does not test compliance with GDPR or the DPDP Act either.
- Adding Availability with no tested recovery. The A1 questions expect evidence that a restore or failover was actually exercised during the period. A plan on paper is a weak answer.
- Leaving out a category your SLA plainly promises. A buyer who reads an uptime promise in your contract and finds no Availability in the report will ask why.
- Collecting categories to look thorough. Five categories do not make a report stronger to a reader who needed only one. They do make every year's examination larger.
Sources: AICPA, TSP Section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with Revised Points of Focus, 2022); AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy; COSO, Internal Control: Integrated Framework (2013).
06 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
- The Security category, criterion by criterionCC1 to CC9 in plain words, with the evidence each invites.
- The Availability categoryA1.1 to A1.3: capacity, protection and tested recovery.
- The Confidentiality categoryC1.1 and C1.2: identifying, protecting and disposing of confidential data.
- The Privacy categoryP1 to P8: notice, choice, collection, use, access, disclosure, quality, monitoring.
- The Processing Integrity categoryPI1.1 to PI1.5: complete, valid, accurate and timely processing.
- Picking categories beyond SecurityWhich of the five categories your customers actually need.
Questions teams ask about the criteria
Can a SOC 2 skip the common criteria if we only care about uptime?
No. CC1 to CC9 come with every SOC 2.
The common criteria are the base of the examination. Availability, Confidentiality, Processing Integrity and Privacy can only be layered on top of them, never examined alone.
Do we have to address every point of focus?
No, they guide your thinking rather than bind it.
Points of focus describe what a criterion commonly involves. Some will not fit your system. The auditor's question is whether the criterion is met, so be ready to explain why a point of focus does not apply where you skipped it.
Why does CC8 have only one criterion when change is so risky?
One criterion, but it covers the whole change life cycle.
CC8.1 asks that changes to infrastructure, data, software and procedures are authorised, designed, tested, approved and implemented in a controlled way. Auditors commonly sample many individual changes under that single line, so it is rarely a small part of fieldwork.
We changed categories this year. What does a reader see?
Each report names the categories it covers.
The report states which categories were in scope for that period. A category added this year has no history in earlier reports, so readers comparing reports year to year will notice the change. Make additions at the start of a period so the new controls run for its full length.
Know which questions your report has to answer.
In a SOC 2 readiness assessment we trace each customer promise to a category, then check that every criterion in scope has a control, an owner and evidence behind it.