TSP section 100
TSP 100: how the Trust Services Criteria document works.
TSP section 100 holds the AICPA's 2017 Trust Services Criteria. Most guides list what the criteria say. This one explains the structure: what is required, what is only guidance, how it lines up with COSO, and how you turn it into controls of your own.
Back to SOC 2 services01 · Structure
Three levels, only two of them binding
Categories group criteria; points of focus describe what a criterion usually involves.
- 1CategoriesSecurity, Availability, Processing Integrity, Confidentiality, Privacy. Security is always in scope.
- 2CriteriaThe statements controls must meet, such as the common criteria CC1 to CC9 and the category-specific ones.
- 3Points of focusCharacteristics that often apply to a criterion. Guidance, not requirements.
02 · Points of focus
Points of focus are not a checklist
They need not be met individually; the criterion must be met.
Criterion
Required
- Must be met by your controls
- Tested by the CPA firm
- Failure can modify the opinion
Point of focus
Considered
- Helps design and evaluate controls
- Some may not apply to your system
- Not required to be met one by one
Treating every point of focus as a mandatory control is a common cause of over-built SOC 2 programs.
How an auditor uses them
- As a prompt when judging whether your controls cover a criterion's intent.
- To spot gaps: if several points of focus have no counterpart, the auditor asks how the criterion is still met.
- Not as a scoring sheet. The opinion is on the criteria, never on points of focus.
03 · 2017 and 2022
Why it is still the 2017 criteria
The 2022 update revised points of focus, not the criteria.
| Document | What it contains | Status |
|---|---|---|
| 2017 Trust Services Criteria | The categories and criteria, aligned to COSO 2013 | The current criteria |
| Revised points of focus, 2022 | Updated and added points of focus; criteria text left in place | Current, issued with the 2017 criteria |
| Earlier “principles and criteria” | The pre-2017 structure | Superseded |
The AICPA's published set is the 2017 criteria, carrying a 2022 update to the points of focus. A report citing the 2017 criteria is current; one citing the older principles is not.
04 · COSO alignment
The common criteria follow COSO
CC1 to CC5 track the five COSO components; CC6 to CC9 add technology-specific criteria.
| Common criteria | COSO 2013 component |
|---|---|
| CC1 | Control environment |
| CC2 | Information and communication |
| CC3 | Risk assessment |
| CC4 | Monitoring activities |
| CC5 | Control activities |
| CC6 to CC9 | Supplemental criteria added to COSO's set: who can get in (digital and physical), day-to-day operations, controlled change, and handling of vendors and business disruption |
Because of this alignment, a company that already reports on internal control under COSO will recognize much of CC1 to CC5. The detail of each criterion is on our Trust Services Criteria and Security category guides.
05 · Writing controls
Writing your own controls to the criteria
TSP 100 sets outcomes; you decide the controls.
- Read the criterion and say in one sentence what outcome it wants.
- Scan the points of focus for the parts that fit your system.
- Write controls that state who does what, how often, and where the evidence lives.
- Map each control to every criterion it supports; one control often supports several.
- Check that each criterion has enough controls to meet it on its own terms.
An illustrative control
“The engineering manager reviews production access quarterly in the identity provider; removals are ticketed and closed within five business days.” It is specific, testable and maps to the access criteria.
Sources: AICPA 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (TSP section 100), with revised points of focus (2022); COSO Internal Control, Integrated Framework (2013); AICPA SOC 2 guide. Controls shown are illustrative.
Questions about TSP 100
Do we fail if we skip a point of focus?
No, if the criterion is still met.
Points of focus are guidance. The auditor evaluates whether your controls meet the criterion; a missing point of focus only matters if it leaves the criterion unmet.
Did the 2022 update change what we must comply with?
It changed the guidance, not the criteria.
The criteria are still the 2017 set. The 2022 revision updated points of focus, which may change how you and your auditor think about a criterion.
Can our controls use different words from the criteria?
Yes, and they should.
Controls describe your practice. The mapping shows which criterion each one supports; copying the criterion text as a control makes it untestable.
Are the Trust Services Criteria only for SOC 2?
No.
The same criteria are used in SOC 3, can serve as control criteria in a SOC for Cybersecurity engagement, and can be used in consulting work.
Turn the criteria into controls that fit.
We map your existing practices to TSP 100 and write the controls that close the gaps, without over-building.