SOC 2 Trust Services Criteria Explained: The 5 Categories

The SOC 2 Trust Services Criteria are the standards an auditor uses to evaluate your controls. Published by the AICPA, they cover five categories: Security, Availability, Confidentiality, Processing Integrity and Privacy. Every SOC 2 report includes Security. The other four are optional, and choosing them well keeps your audit focused and affordable.

Related guides: How to prepare for a SOC 2 audit · Mapping SOC 2 and ISO 27001 common criteria · SOC 2 policies and procedures

Key takeaways

• There are five Trust Services Criteria (TSC). Security is mandatory, and the other four are added only when customers need them.
• Security is built on the common criteria CC1 to CC9, which also apply to every other category you include.
• The criteria were issued in 2017 and the points of focus were revised in 2022, adding detail on topics such as risk, change management and privacy.
• Points of focus are guidance, not a checklist. Your auditor tests the controls you design to meet each criterion.

---

What are the SOC 2 Trust Services Criteria?

The Trust Services Criteria (TSC) are a set of control criteria developed by the AICPA for evaluating how a service organization protects information and systems. In a SOC 2 examination, you describe your system and your controls, and the auditor tests whether those controls meet the criteria you chose. People sometimes call them the SOC 2 "trust principles", which was the older name.

The five Trust Services Criteria categories

Category	What it covers	When to include it
Security (required)	Protection against unauthorized access, disclosure and damage	Always. It is the foundation of every SOC 2 report
Availability	Systems are available for operation and use as committed	You promise uptime, SLAs or recovery times
Confidentiality	Information designated as confidential is protected	You handle sensitive business data such as financials or IP
Processing Integrity	Processing is complete, valid, accurate, timely and authorized	Customers rely on your calculations, payments or data processing
Privacy	Personal information is collected, used, retained and disposed of properly	You collect personal data directly from individuals

The common criteria: CC1 to CC9

The Security category is organized into nine groups of common criteria. They follow the COSO internal control framework for CC1 to CC5 and add security-specific groups for CC6 to CC9.

Series	Name	Typical controls
CC1	Control environment	Code of conduct, org structure, background checks, board or leadership oversight
CC2	Communication and information	Policies communicated to staff, system description, customer commitments
CC3	Risk assessment	Annual risk assessment, fraud risk, change in risk factors
CC4	Monitoring activities	Internal reviews, control monitoring, reporting deficiencies
CC5	Control activities	Policies and procedures, technology controls, segregation of duties
CC6	Logical and physical access	SSO, MFA, access reviews, onboarding and offboarding, encryption, physical security
CC7	System operations	Monitoring, vulnerability management, incident detection and response
CC8	Change management	Code review, testing, approvals and deployment controls
CC9	Risk mitigation	Vendor management, business disruption risk, insurance

The additional criteria

• Availability (A1): capacity planning, environmental protections, backups, recovery plans and recovery testing.
• Confidentiality (C1): identifying confidential information, protecting it, and disposing of it when no longer needed.
• Processing Integrity (PI1): quality of inputs, processing accuracy, output completeness and error handling.
• Privacy (P1 to P8): notice, choice and consent, collection, use and retention, access, disclosure, quality, and monitoring and enforcement.

What changed with the 2022 revised points of focus?

In 2022 the AICPA revised the points of focus that support the 2017 criteria. The criteria themselves did not change, but the guidance became more detailed in areas such as risk assessment, change management, data classification, the management of confidential information and privacy. Reports issued now are prepared using the revised points of focus. If your controls were designed against the older guidance, review them with your auditor, particularly around risk identification and confidential data handling.

How to choose which criteria to include

1. Start with Security only unless customers have asked for more.
2. Add Availability if your contracts include uptime commitments or SLAs.
3. Add Confidentiality if customers share sensitive non-personal data with you.
4. Add Processing Integrity only if accuracy of processing is a core promise, such as payroll or payments.
5. Add Privacy carefully. It adds many controls and overlaps with GDPR and other privacy laws. Many SaaS companies address privacy through GDPR compliance instead.

Every extra category adds controls, evidence and audit cost, so include only what your buyers need.

Example controls for each criterion

Concrete examples make the criteria easier to apply. These are typical controls for a cloud-based SaaS company of up to 50 people:

Criterion	Example controls
CC1 Control environment	Signed code of conduct at hire; background checks for staff with production access; security responsibilities in job descriptions
CC2 Communication	Security policies published on the intranet; security updates in all-hands; a customer-facing security page and support contact
CC3 Risk assessment	Annual risk assessment covering fraud and technology changes; risks scored and assigned owners
CC4 Monitoring	Quarterly internal control reviews; leadership reviews of security metrics; tracking of deficiencies to closure
CC5 Control activities	Documented procedures; segregation of duties for production changes; technology controls enforced by configuration
CC6 Access	SSO and MFA; role-based access; quarterly access reviews; same-day offboarding; encryption at rest and in transit
CC7 Operations	Centralized logging and alerting; vulnerability scanning; incident response plan and postmortems
CC8 Change management	Pull requests with peer review; automated tests; protected main branch; emergency change process
CC9 Risk mitigation	Vendor inventory and reviews; cyber insurance; business continuity planning
A1 Availability	Uptime monitoring; backups; disaster recovery plan tested yearly
C1 Confidentiality	Data classification; confidential data encrypted and access-restricted; secure deletion at contract end

The criteria and your system description

Every SOC 2 report includes a system description written by your company. It explains the services in scope, infrastructure, software, people, data and procedures, plus the principal service commitments you make to customers, such as uptime or encryption. The auditor tests your controls against the criteria in the context of those commitments. Writing the system description early forces useful decisions about scope and shows which criteria you really need. Keep it accurate and specific. Vague descriptions lead to follow-up questions and slow fieldwork.

Complementary user entity controls

Some controls depend on your customers. For example, customers must manage their own user accounts in your product. These are listed in the report as complementary user entity controls (CUECs). Customers read them to understand what they must do for the controls to work.

How the criteria map to other frameworks

The common criteria overlap heavily with ISO 27001 Annex A, HIPAA safeguards and NIST frameworks. Access control (CC6), operations (CC7) and change management (CC8) map closely to ISO 27001 Annex A 5.15 to 5.18, 8.15, 8.16 and 8.32. Using a common control framework lets one control satisfy several criteria at once.

How SecureSlate helps

SecureSlate maps its SOC 2 control set to each Trust Services Criterion, tests technical controls automatically and reuses the same evidence for ISO 27001 and HIPAA through multi-framework mapping.

FAQ

How many Trust Services Criteria are there?

There are five categories: Security, Availability, Confidentiality, Processing Integrity and Privacy. Security is required in every SOC 2 report.

What are the SOC 2 common criteria?

They are the nine groups of criteria, CC1 to CC9, that make up the Security category and apply to every SOC 2 report.

Are the trust services principles the same as the criteria?

Yes. "Trust services principles" was the older name. The AICPA now uses "Trust Services Criteria".

Do we have to meet every point of focus?

No. Points of focus are guidance that help you design controls. The auditor evaluates whether your controls meet the criteria, not whether you addressed every point of focus.

Which Trust Services Criteria do most SaaS companies choose?

Most choose Security, and many add Availability and Confidentiality. Processing Integrity and Privacy are less common.

---

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory, or professional advice. Requirements vary by framework, industry, and jurisdiction. Consult qualified advisors for your specific obligations.