SOC 2 Trust Services Criteria: The Five Categories and What Each Requires
The five SOC 2 Trust Services Criteria explained: what Security, Availability, Confidentiality, Processing Integrity and Privacy require, and what to pick.
13 min readBy Sachin Shirish, Director
Reviewed by Pragya Dwivedi, Associate Director, CISM (ISACA), eWPTX (INE Security)
The SOC 2 Trust Services Criteria are the AICPA's yardstick for a SOC 2 report: five categories, Security, Availability, Processing Integrity, Confidentiality and Privacy, against which a licensed CPA firm tests your controls. Security is mandatory in every report and carries 33 criteria. The other four are optional and add 28 more between them. You choose the categories, the auditor tests every criterion inside the ones you choose, and that choice decides most of what the audit costs you in effort.
At a Glance
- Who publishes them: the AICPA, as the 2017 Trust Services Criteria with revised points of focus (2022). The 2022 revision changed the points of focus, not the criteria themselves.
- How many there are: 61 criteria in total. Security has 33 (the common criteria, CC1 to CC9), Availability 3, Confidentiality 2, Processing Integrity 5 and Privacy 18.
- What is mandatory: Security only. Its criteria are common to every SOC 2 report; the rest are added when your service commitments call for them.
- What they are not: a control list. The criteria state outcomes. You design the controls that meet them, which is why two SOC 2 reports rarely look alike.
- What is changing: the AICPA has published exposure drafts of proposed 2027 criteria. Until they are final, reports are issued against the current set.
What the Trust Services Criteria Actually Are
A SOC 2 examination needs something to measure against, and the Trust Services Criteria are that measure. Each criterion is a statement of what a well-run service organisation achieves. CC6.1, for example, says the entity implements logical access security over protected information assets. It does not say "use single sign-on" or "rotate keys every 90 days". Those are controls, and choosing them is your job.
Under each criterion the AICPA lists points of focus: the characteristics an auditor considers when judging whether your controls meet it. Points of focus are guidance, not a checklist. You are not required to address every one, and a control set that ticks each point of focus while missing the criterion's intent still fails.
That design is the reason SOC 2 suits companies of very different shapes, and it is also the reason first-time teams struggle. There is no official control list to download. What exists is 61 outcome statements, a set of points of focus, and an auditor who will ask how your particular system achieves each one.
The Five Categories Compared
The matrix below is the short version. The sections after it take each category in turn.
| Category | Criteria | Mandatory? | What it covers | Include it when |
|---|---|---|---|---|
| Security (common criteria) | CC1 to CC9, 33 criteria | Yes, always | Protection of systems and data against unauthorised access, and the governance around it | Always |
| Availability | A1.1 to A1.3 | No | Capacity, backup, recovery and resilience against the uptime you committed to | You sign an SLA or customers depend on you being up |
| Confidentiality | C1.1 to C1.2 | No | Identifying, protecting and disposing of information designated confidential | You hold customer data under NDA or contract terms |
| Processing Integrity | PI1.1 to PI1.5 | No | Processing that is complete, valid, accurate, timely and authorised | Customers rely on your calculations or transactions |
| Privacy | P1.1 to P8.1, 18 criteria | No | Notice, consent, collection, use, retention, access, disclosure and quality of personal information | You are the party deciding how personal information is used |
Security: The Nine Common Criteria
Security's criteria are called the common criteria because they are shared by all five categories; on their own they make up the Security category. They are organised into nine series.
| Series | Name | Criteria | What an auditor looks for |
|---|---|---|---|
| CC1 | Control environment | 5 | Board or founder oversight, an organisation chart with accountability, hiring and conduct standards |
| CC2 | Communication and information | 3 | Policies reaching staff, security commitments reaching customers, a way to report incidents |
| CC3 | Risk assessment | 4 | A dated risk assessment, including fraud risk and the effect of significant change |
| CC4 | Monitoring activities | 2 | Internal checks that controls still work, and deficiencies tracked to closure |
| CC5 | Control activities | 3 | Controls chosen against the risks, with technology controls and policies behind them |
| CC6 | Logical and physical access | 8 | Provisioning and removal of access, authentication, encryption, physical security, malware defence |
| CC7 | System operations | 5 | Vulnerability detection, monitoring, incident response and recovery |
| CC8 | Change management | 1 | Changes authorised, tested and approved before release |
| CC9 | Risk mitigation | 2 | Business disruption planning and vendor risk management |
CC1 to CC5 mirror the seventeen principles of the COSO internal control framework, which is why they read like governance rather than security. They are where young companies are weakest, because a ten-person startup has working engineering practice and no written evidence of oversight. CC6 to CC8 are where most of the evidence volume sits: access reviews, joiner and leaver tickets, change approvals and monitoring alerts, sampled across the audit period.
No criterion requires a penetration test. The AICPA names it only as an example in a CC4.1 point of focus, alongside ISO certification and internal audit, and CC7.1's points of focus call for vulnerability scans. In practice auditors commonly accept a penetration test as evidence for both. Our page on SOC 2 penetration testing covers what scope and timing satisfy them.
Availability
Availability has three criteria. A1.1 asks that you monitor and manage processing capacity. A1.2 asks for environmental protections, backups and recovery infrastructure. A1.3 asks that you test the recovery plan. The category measures you against the commitments you made, not against an absolute standard: if your contract promises 99.9 percent uptime, that is what the auditor tests your controls against.
Add it when you sign service level agreements or when an outage on your side stops your customer's business. For a SaaS company already running on a major cloud with multi-zone deployment, the incremental work is usually a tested restore, a written recovery plan and capacity monitoring evidence.
Confidentiality
Confidentiality has two criteria. C1.1 asks that you identify and maintain confidential information; C1.2 asks that you dispose of it in line with your confidentiality objectives, typically at the end of the retention period or contract. In practice that means a data classification scheme that staff use, encryption and access restriction for what is classified, and deletion evidence at the end of a contract.
With only two criteria it is usually among the lightest categories to add, and it is commonly requested because most enterprise contracts contain a confidentiality clause. Do not confuse it with Privacy. Confidentiality covers any information you have agreed to protect, such as source code, financial data and business plans. Privacy covers personal information specifically.
Processing Integrity
Processing Integrity has five criteria, covering the definition of what is processed, inputs, the processing itself, outputs and storage. It asks whether your system does what it says, completely, accurately and on time.
It belongs in the report when customers rely on your system's output without checking it: payment processing, payroll, billing, lending decisions, analytics that feed a customer's own reporting. It is rarely worth adding for a collaboration or infrastructure product, and it brings application-level evidence such as input validation, reconciliation and error handling that the other categories do not touch.
Privacy
Privacy is the largest optional category, with 18 criteria across eight series: notice (P1), choice and consent (P2), collection (P3), use, retention and disposal (P4), access (P5), disclosure and notification (P6), quality (P7), and monitoring and enforcement (P8).
It applies cleanly when you decide why and how personal information is processed. Many B2B SaaS companies only process personal information on a customer's instructions, and for them much of the category does not fit, which is why auditors often advise leaving it out and covering the data with Confidentiality instead. If you do collect personal information directly from individuals in India, the category overlaps heavily with the DPDP Act, and our guide to SOC 2 and DPDPA compliance maps one to the other.
Which Categories to Include
Scope is a commercial decision before it is a technical one. Three inputs settle it.
- What your customers have asked for. Read the security questionnaire or the contract clause. If it names categories, those are your scope.
- What you have committed to. An SLA points to Availability. A confidentiality clause points to Confidentiality. Financial or transactional processing points to Processing Integrity.
- What you can evidence this year. Every category you add is tested in full. A category included and failed appears in the report as an exception your customer will read.
A common first scope for a SaaS company is Security alone, or Security with Availability and Confidentiality. Categories can be added in a later period, so a narrow first report is not a permanent decision. The choice of report type is separate, and our comparison of SOC 2 Type 1 vs Type 2 covers it.
What SecureRoot Does, and Does Not Do
SecureRoot runs the readiness side: we map your system to the criteria, design the controls, set up evidence collection and support you through the audit. Our published range for that work is Rs 1.5 lakh to Rs 4.5 lakh, the same for either report type, with a Type 1 typically reached in eight to twelve weeks. The detail is on our SOC 2 service page, and how SOC 2 works in India walks through an engagement.
We are not a CPA firm and we do not issue SOC 2 reports. Only a licensed CPA firm can, it has to be independent of whoever built the controls, and its fee is quoted separately.
Frequently Asked Questions
Are all five Trust Services Criteria required for SOC 2?
No. Only Security is required, and a report covering Security alone is a complete and valid SOC 2 report. The other four categories, Availability, Confidentiality, Processing Integrity and Privacy, are added when your services and the commitments you have made to customers call for them. The decision is yours rather than the auditor's, but the auditor will challenge a scope that leaves out something your contracts plainly promise, such as an uptime commitment with no Availability category behind it. The cost of over-scoping is real: every criterion in an included category is tested, and a failure in a category nobody asked for still appears in the report your customers read. A common first scope for a SaaS company is Security, often with Availability and Confidentiality, and many extend in later periods once the base control set has been running smoothly for a full year.
How many controls does SOC 2 require?
SOC 2 does not prescribe a number, because the Trust Services Criteria state outcomes rather than controls. There are 61 criteria across the five categories, 33 of them in Security, and you design however many controls your system needs to meet the ones in scope. The total differs widely from one company to the next, because it follows the shape of the system and the team, and every category you add pushes it higher. The count matters less than the fit. A smaller set of controls that genuinely operate and leave evidence is easier to audit and easier to run than a long list copied from a template, where half the entries describe things your team does not do. Auditors test what you wrote down, so every control you claim is a control you must evidence for the whole period under review.
What is the difference between criteria, points of focus and controls?
A criterion is the requirement: an outcome the AICPA says a service organisation must achieve, such as restricting logical access to authorised users. Points of focus are the AICPA's guidance under each criterion, describing characteristics an auditor considers when judging whether it is met. They are not requirements, and you do not need to address each one. Controls are yours: the specific policies, configurations and procedures you put in place to meet the criterion, such as single sign-on with enforced multi-factor authentication and a quarterly access review. The auditor's opinion is about whether your controls, taken together, meet each criterion in scope. That is why a control matrix maps every control to one or more criteria, and why the same control, a quarterly access review for instance, can satisfy several criteria at once without being written twice.
Should a SaaS company include the Privacy category?
Usually not in a first report, and often not at all. The Privacy criteria are written for an organisation that decides why and how personal information is collected and used. A B2B SaaS company typically processes personal information on its customers' instructions, so criteria about giving notice and obtaining consent from individuals do not fit its role, and an auditor has to mark many of them as not applicable. Confidentiality usually covers the same data more cleanly. Privacy does make sense when you collect personal information directly from individuals for your own purposes, as a consumer app or a health or lending platform does. In that case the eighteen criteria overlap substantially with obligations under India's DPDP Act and the GDPR, and a single control set can serve all three if it is designed with that in mind from the start.
Did the 2022 update change the SOC 2 criteria?
No. The 2022 update revised the points of focus and left the criteria themselves as they were in 2017, which is why the document is titled the 2017 Trust Services Criteria with revised points of focus. The revisions clarified how the criteria apply to newer risks and environments, with more explicit attention to matters such as data management, changing threats and the distinction between an organisation that controls personal information and one that processes it for others. A report issued today is still measured against the same 61 criteria. A larger change is in progress: the AICPA has published exposure drafts of proposed 2027 criteria and description criteria. Nothing in a draft binds an audit yet, so plan against the current set and ask your CPA firm which version will apply to the period you are scoping.
Where to Start
Start with the customer request in front of you and work out which categories it actually names. Then check each criterion in those categories against what your team already does, because the gap is usually evidence rather than practice. If you want that mapping done against your own system, request an assessment and we will tell you which categories fit, what is missing, and how long closing it will take.
Have a Question About This?
If this raised something specific to your environment, a scoping call is the fastest way to get a direct answer.
We reply within one business day.
See Every Published Price Band