Menu
On this page
On 26 October 2026 the AICPA’s Assurance Services Executive Committee released an exposure draft of proposed 2027 SOC 2 Trust Services Criteria. If the AICPA issues it as final, it will be effective for engagements beginning on or after 31 December 2027, and early implementation would be permitted. Comments are requested by 15 January 2027. The draft cuts the criteria from 61 to 50 and the common criteria from 33 to 20, renumbered CC1 to CC8, and adds AI wording to the points of focus under 17 criteria but no AI-specific criterion. It is a proposal and can change. Today’s 61 criteria are covered in SOC 2 Trust Services Criteria.
Key dates and status
| Item | Date or status |
|---|---|
| Draft released | 26 October 2026, the date on the AICPA download page. The draft’s cover is dated 27 October 2026. |
| Comments requested by | 15 January 2027 |
| Effective, if issued as final | Engagements beginning on or after 31 December 2027; early implementation would be permitted |
| Criteria in use today | SOC 2 reports use the 2017 criteria with revised points of focus (2022) today |
| Description Criteria draft | Named on the AICPA page alongside this draft, but only the Trust Services Criteria files were posted there as of 28 October 2026 |
| AI guidance | The draft says guidance on applying the criteria to AI components is “currently under development” |
What changes: 61 criteria become 50
| Category | 2017 criteria | Proposed 2027 |
|---|---|---|
| Common criteria (Security) | 33 (CC1–CC9) | 20 (CC1–CC8) |
| Availability | 3 (A1.1–A1.3) | 4 (A1.1–A1.4) |
| Confidentiality | 2 (C1.1–C1.2) | 3 (C1.1–C1.3) |
| Processing Integrity | 5 (PI1.1–PI1.5) | 5 (PI1.1–PI1.5) |
| Privacy | 18 (P1–P8) | 18 (P1–P8) |
| Total | 61 | 50 |
Counts exclude the P1.0 to P8.0 series headings, as our current criteria page does. The Notice to Readers gives two aims: reduce complexity, and modernize the criteria for emerging technology, AI in particular, without tying them to today’s technology.
The proposed common criteria run in eight series:
| Series | Criteria | Replaces (2017 series, criteria) | Criteria and their short titles |
|---|---|---|---|
| CC1 Control environment | 2 | CC1 Control environment, 5 | CC1.1 Integrity and Ethical Values; CC1.2 Commitment to Competence |
| CC2 Information and communication | 2 | CC2 Information and communication, 3 | CC2.1 System Documentation; CC2.2 Communication of Policies, System Components, and Responsibilities |
| CC3 Risk assessment | 3 | CC3 Risk assessment, 4 | CC3.1 Establish and Structure the Risk Management Program; CC3.2 Execute the Risk Management Program; CC3.3 Monitor and Improve the Risk Management Program |
| CC4 Monitoring activities | 1 | CC4 Monitoring activities, 2 | CC4.1 Monitoring and Communication of Deficiencies |
| CC5 Logical and physical asset protection | 6 | CC6 Logical and physical access, 8 | CC5.1 Logical Access Over System Resources; CC5.2 Data Center and Facility Management; CC5.3 Management of Information Technology Devices and Software; CC5.4 Network Integrity and Boundary Protection; CC5.5 Encryption of Data; CC5.6 Vulnerability Identification and Management |
| CC6 System operations | 2 | CC7 System operations, 5 | CC6.1 Monitoring and Operation of System Components; CC6.2 Incident Response Programs |
| CC7 System development and change management | 3 | CC8 Change management, 1 | CC7.1 Infrastructure Development & Change Management; CC7.2 Acquired Software Development & Change Management; CC7.3 Internally Developed Software Development & Change Management |
| CC8 Vendor management | 1 | CC9 Risk mitigation, 2 (its vendor criterion; the business-disruption content went to A1.3) | CC8.1 (no separate title; the series heading is Vendor Management) |
The 2017 CC5 Control activities series (3 criteria) has no successor series. The series that mirrored the 17 COSO principles (2017 CC1 to CC5) go from 17 criteria to 8, and the rest from 16 to 12, with change management growing from 1 criterion to 3.
Other changes in the text:
- Short titles. Almost every criterion has one; CC8.1, P4.2, P5.2 and P6.7 do not.
- Which engagements use which version. The draft is designed for SOC 2 and SOC 3 engagements and says the 2017 criteria are intended for SOC for Cybersecurity and SOC for Supply Chain.
- No COSO references. In the 2017 criteria, CC1.1 to CC5.3 each cite one of 17 COSO principles; the draft does not mention COSO.
- “Those charged with governance” is the draft’s term where the 2017 criteria said board of directors. The glossary defines it as the people who oversee the entity’s direction and accountability, such as a board, trustees, general partners for a partnership, or the senior executives or owners of a small business.
- Third-party points of focus. CC8.1 adds “Assesses Subservice Organization” (reviewing SOC or other third-party assurance reports, identifying complementary user entity controls) and “Evaluation of Third-Party Components” (hardware, software, AI models, APIs, plugins).
Where each 2017 criterion goes
This table is our reading of the AICPA’s redlined draft. The draft includes no map from the 2017 criteria, and its own text controls. We matched each 2017 criterion to where its wording and named points of focus reappear; some have no direct successor. The Notice to Readers says the restructuring included removing unnecessary criteria.
| 2017 criterion | Where it goes in the draft |
|---|---|
| CC1.1 Integrity and ethics | CC1.1. The point on addressing deviations from standards of conduct is not carried over. |
| CC1.2 Board independence and oversight | CC1.1 (“Objective Oversight” point only). The oversight-responsibilities and board-expertise points are not carried over. |
| CC1.3 Structures, reporting lines, authorities | No direct successor. |
| CC1.4 Competence | CC1.2. |
| CC1.5 Accountability | No direct successor. Its points on individual performance measures, incentives and discipline do not appear. |
| CC2.1 Quality information | CC2.1. Points on system components, classification, asset location and data flow carry over, some renamed (Manages Assets became System Components and Data). The COSO-derived information-requirement and quality points are not carried over. |
| CC2.2 Internal communication | CC2.2. The point on security awareness training is not carried over. |
| CC2.3 External communication | CC2.2 in part (“Communicates External Responsibilities”, reporting channels). The points on communicating with shareholders, regulators and other outside parties are not named. |
| CC3.1 Objectives | No direct successor. Nearest text: new CC3.1, a risk program built around system objectives and risk tolerance. The operations, reporting and compliance objective points are not carried over. |
| CC3.2 Risk identification and analysis | CC3.2. |
| CC3.3 Fraud risk | CC3.2, as the “Fraud Risk Considerations” point. |
| CC3.4 Significant changes | CC3.3 (recalibrating the risk framework after business, technology or legal and regulatory changes; reviewing risk responses after events such as a leadership change). |
| CC4.1 Ongoing and separate evaluations | CC4.1. |
| CC4.2 Communicating deficiencies | CC4.1, whose wording covers telling management and those charged with governance about deficiencies and taking corrective action. |
| CC5.1 Control activities that reduce risk | No direct successor. The segregation-of-duties point has a counterpart in “Segregation of Duties” in new CC5.1. |
| CC5.2 General technology controls | No direct successor. |
| CC5.3 Policies and procedures | CC2.1 (policies and procedures points) and CC1.2, where the “Establishes Responsibility and Accountability” point is narrowed to hiring, onboarding and training. |
| CC6.1 Logical access security | CC5.1, with asset inventory in CC5.3, network segmentation and points of access in CC5.4, and encryption and key protection in CC5.5. |
| CC6.2, CC6.3 User access | CC5.1. |
| CC6.4 Physical access | CC5.2. |
| CC6.5 Disposal of physical assets | CC5.3 (“Removes Data and Software for Disposal”). |
| CC6.6 Outside threats | CC5.4 (additional authentication, boundary protection) and CC5.5 (protecting credentials in transmission). |
| CC6.7 Data transmission and removal | CC5.5 (encryption, secure channels, removable media) and CC5.4 (data loss prevention). |
| CC6.8 Malicious software | CC5.3 (restricting installs, antivirus, malware scanning) and CC5.6 (detecting unauthorized changes to software and configuration). |
| CC7.1 Configuration and vulnerabilities | CC5.6 (vulnerability scans, detecting unauthorized changes) and CC5.3 (configuration standards). |
| CC7.2 Monitoring for anomalies | CC6.1. |
| CC7.3 Evaluating security events | CC6.1 (deciding whether an event is an incident, assessing impact on confidential or personal information) and CC6.2 (analyzing and responding). |
| CC7.4, CC7.5 Incident response and recovery | CC6.2. |
| CC8.1 Change management | CC7.1 (infrastructure), CC7.2 (acquired software) and CC7.3 (internally developed software). For the controls behind each, see SOC 2 change management controls. |
| CC9.1 Business-disruption risk mitigation | No counterpart in the common criteria. The planning point moves to A1.3, an Availability criterion. The insurance point is not carried over. |
| CC9.2 Vendor and business-partner risk | CC8.1. |
| A1.1 Capacity | A1.1. |
| A1.2 Environment, backup, recovery infrastructure | A1.2 (environmental protections) and A1.3 (backup, off-site storage, alternate processing, data recoverability). |
| A1.3 Recovery plan testing | A1.4 Resilience & Recovery Testing. |
| C1.1 Confidential information | C1.1 (classification and inventory) and C1.2 (maintenance, retention, access and encryption). |
| C1.2 Disposal of confidential information | C1.3 Disposal of Data. |
| PI1.1 to PI1.5 Processing integrity | Same numbers, short titles added, some wording edited; PI1.1 now covers information given to people who operate or monitor processing. |
| P1.1 to P8.1 Privacy | Same numbers except P3.2, which becomes P2.2 Communicates Explicit Consent. P3 now holds only P3.1. |
Points of focus are not individually required (paragraph .08). The draft does not address controls you already run; ask your CPA firm.
The AI and emerging-technology points of focus
A point of focus is a listed characteristic the AICPA attaches to a criterion to help management and the CPA firm judge whether controls meet it. The draft adds no AI criterion. AI wording appears in the points of focus under 17 of the 50 criteria: 12 of 20 common criteria, 1 of 4 Availability, 0 of 3 Confidentiality, 3 of 5 Processing Integrity and 1 of 18 Privacy. Paragraph .08 keeps the rule that none requires a specific control, and paragraph .04 adds that AI-related competencies are considered under CC1.2 even though no point of focus identifies the specific AI competencies needed.
| Criterion | Point of focus | What it covers |
|---|---|---|
| CC1.2 | Considers Changes in Technologies | AI is considered in technical training. |
| CC2.2 | Communication of Emerging Technology Operational Considerations; User Awareness of AI-Generated Outputs | People who operate or supervise emerging-technology components, such as AI systems, are told what to consider; users are told when AI generated an output and given guidance when a person validates it. |
| CC3.2 | AI Risk Considerations | Training data manipulation, adversarial inputs, model misuse, reliability, bias, prompt manipulation, data poisoning. |
| CC3.3 | Risk Management Framework | Recalibration when AI or blockchain is introduced, including model drift, lack of explainability, inadequate validation data. |
| CC5.1 | Uses Access Control Structures; Reviews Access Roles and Rules | Access risks from robotic process automation and AI agents; review of AI or other technology accounts that do not need access. |
| CC5.3 | Restricts Unsanctioned Technology Use; Detects Unauthorized Software | Unsanctioned AI platforms; unauthorized AI tools and models. |
| CC5.6 | Conducts Vulnerability Scans; Mitigation of Attacks on AI Platforms | Scans using traditional and AI-enabled techniques; prompt injection, jailbreak chaining, data poisoning. |
| CC6.1 | Designs Detection Measures; Monitoring AI Components; Detection of Anomalous Model Behavior or Outputs | Malicious prompts; drift, degradation, bias amplification, unexpected outputs; model behavior that deviates from expectations. |
| CC7.1 | Manages Patch and Vulnerability Changes | Patching informed by traditional vulnerability scanning and/or AI-enabled techniques. |
| CC7.2, CC7.3 | Changes to Data Affecting AI Components of the System; Detection of Vulnerabilities and Adversarial Inputs | When the entity can train a model, changes to training data, fine-tuning datasets and reinforcement inputs are authorized, validated and protected; detection of prompt injection and attempts to extract a model or its training data. |
| CC8.1 | Evaluation of Third-Party Components | AI models, APIs and plugins are evaluated for security and reliability before use and after updates. |
| A1.1 | Protects Against Resource Exhaustion | Excessive API calls or AI prompts that could degrade availability. |
| PI1.1 | AI and Machine Learning in System Inputs | Data quality checks, lineage and provenance, validation of data used to train, fine-tune or operate models. |
| PI1.3 | AI and Machine Learning in System Processing | Pre-deployment validation, bias testing, revalidation after retraining or material change. |
| PI1.4 | AI and Machine Learning in System Output | Output monitoring, drift detection, human review or override. |
| P4.1 | Protects Personal Data in AI Systems | Personal information is not improperly retained or exposed by AI models. |
Several are conditional: the model-training point applies when the entity can train a model, and the processing point when AI or machine learning models perform, support or influence processing. The A1, PI1 and P4 points apply only when that category is in the engagement. For an AI company’s audit, see SOC 2 for AI companies and SOC 2 controls for AI agents and MCP.
What does not change
- Outcomes and categories. Paragraph .03: the criteria set out what an entity’s controls would ordinarily achieve, not a set of controls. The five categories stay, with the common criteria under every one; Security needs no criteria beyond them.
- A category is usually addressed whole. Paragraph .11 keeps “all criteria for that category are usually addressed”, except a criterion that does not apply, such as P3.1 for a service that does not collect personal information directly.
What it means for your next audit
The draft says nothing about cost or fees, and we make no estimate of either.
Which criteria your report uses
SOC 2 reports use the 2017 criteria today. If the AICPA issues the draft as final, the 2027 criteria apply to engagements beginning on or after 31 December 2027, and early implementation would be permitted. Ask your CPA firm which criteria your engagement will use. When reviewing a vendor’s report, check which criteria it was examined against; a 2017-criteria report will not carry the 2027 AI points of focus.
Ask whether and when your CPA firm would use the 2027 criteria
The draft does not say who decides on early implementation or when, so ask your CPA firm whether and from which engagements it would use the 2027 criteria once final. Ask also how it reads “beginning on or after”: the effective date turns on when an engagement begins, and the draft does not address a Type 2 observation period, a Type 1 report date or a report’s issue date. See SOC 2 Type 1 vs Type 2.
Re-map questionnaires and platform controls keyed to 2017 numbers
If the draft is finalized as written, any control mapping keyed to 2017 criterion numbers (questionnaire answers, spreadsheets, compliance platforms) will need re-mapping. For example:
| Number | In the 2017 criteria | In the draft |
|---|---|---|
| CC5.1 | Selecting control activities that reduce risk | Logical access over system resources |
| CC6.1 | Logical access security | Monitoring and operation of system components |
| CC6.2 | Registering users and issuing credentials | Incident response programs |
| CC7.1 | Detecting configuration changes and new vulnerabilities | Infrastructure development and change management |
| CC7.2 | Monitoring for anomalies | Acquired software development and change management |
| CC8.1 | Change management | Vendor management |
Among the common criteria, CC1.1, CC3.2 and CC4.1 keep their number and subject, and CC2.1 and CC2.2 do so in part, so use the crosswalk above. Until a final version exists, we would keep the 2017 numbers and add a column for the proposed ones rather than replace them. Our SOC 2 controls library and SOC 2 security controls guide follow today’s criteria.
Describe AI use inside the system boundary
Several of the AI points of focus attach to “AI components of the system” or apply when AI models perform, support or influence processing, so ask your CPA firm which AI features are part of your system. We group them in three places:
- In your product: AI components of the service, mainly CC6.1, CC7.2, CC7.3 and, when in scope, the Processing Integrity points.
- In your environment: staff use of AI platforms and tools, CC5.3 (and CC5.1 for access, including AI agents).
- In your supply chain: AI models and APIs you buy, CC8.1.
The Description Criteria, which govern how a report describes the system, are a separate draft: the AICPA’s page names it, but as of 28 October 2026 only the Trust Services Criteria files were posted there. This draft does not cover how the description presents AI. To set the boundary first, see SOC 2 scope determination.
If your scope is Security only
CC9.1 in the 2017 criteria (risk mitigation for potential business disruptions) is a common criterion, so it applies to every report, including Security-only. In the draft its planning point of focus, “Considers Planning for Mitigation of Risks of Business Disruption”, now sits under A1.3 Resilience Capabilities, and the A1 points of focus apply only to an engagement that uses the availability criteria.
Outside Availability, no other point of focus names business-disruption planning. CC6.2 keeps points on restoring operations and testing incident-recovery plans, and CC3.2 lists a business impact analysis as an example of a documented risk-assessment output. The draft does not say how a Security-only report would treat it, so ask your CPA firm. If a customer contract relies on a continuity commitment, ask whether Availability belongs in scope.
How to comment on the draft
Comments are requested by 15 January 2027 from interested persons, and the draft’s cover names an AICPA staff contact. The AICPA download page has the clean draft and a redlined version against the 2017 criteria, and downloading needs a free AICPA account.
Frequently Asked Questions
When do the 2027 criteria take effect?
If the AICPA issues the draft as final, it applies to engagements beginning on or after 31 December 2027, with early implementation permitted. It is not final: comments are requested by 15 January 2027.
Are there new AI criteria in SOC 2?
No. The draft adds AI wording to the points of focus under 17 of its 50 criteria, but no AI-specific criterion, and points of focus are not required.
How many Trust Services Criteria are there in the 2027 draft?
Fifty, against 61 in the 2017 criteria: 20 common criteria (CC1 to CC8), 4 for Availability, 3 for Confidentiality, 5 for Processing Integrity and 18 for Privacy.
Does my 2027 SOC 2 audit use the new criteria?
SOC 2 reports use the 2017 criteria today. If the AICPA issues the draft as final, the 2027 criteria apply to engagements beginning on or after 31 December 2027, and early implementation would be permitted. Ask your CPA firm which criteria your engagement will use.
What happened to CC9?
The draft has no CC9. CC9.2 (vendor risk) becomes CC8.1, in the Vendor Management series. The business-disruption planning point from CC9.1 moves to A1.3 under Availability, and the insurance point is not carried over.
To compare CPA firms by scope, pricing and timeline before your next audit, start with the SOC 2 auditor directory.
More in SOC 2 Basics