Menu
On this page
The SOC 2 Trust Services Criteria (TSC) are the AICPA’s 61 criteria for evaluating a service organization’s controls, grouped into five categories: Security, Availability, Processing Integrity, Confidentiality, and Privacy. They are published in TSP Section 100, the 2017 Trust Services Criteria with revised points of focus (2022), which the AICPA still lists as the current version as of October 2026. The AICPA proposed revised 2027 criteria that month, but they are not final: see what the proposed 2027 criteria change.
Security’s 33 criteria, the Common Criteria (CC1–CC9), are part of the criteria set for every category, so every SOC 2 report covers them. Availability (A1), Processing Integrity (PI1), Confidentiality (C1), and Privacy (P1–P8) only add their own series on top. The AICPA lets the company choose its categories and does not require Security, but nearly every report includes it. You add the other four based on what you promise customers, not because a checklist lists them.
The Five Categories at a Glance
| Category | Criteria series | Criteria | What the criteria test | Include it when |
|---|---|---|---|---|
| Security | CC1–CC9 | 33 | Information and systems are protected against unauthorized access, unauthorized disclosure, and damage. | Almost always. Its criteria apply to every report; without Security, they are judged only against the categories chosen. |
| Availability | A1 | 3 | Systems are available for operation and use as you committed. | Customers rely on an uptime, capacity, or recovery commitment you make. |
| Processing Integrity | PI1 | 5 | System processing is complete, valid, accurate, timely, and authorized. | The service’s output is the product: payments, billing, calculations, data processing done for customers. |
| Confidentiality | C1 | 2 | Information designated confidential is protected, then disposed of. | Contracts or law require you to limit access to, retain, and delete defined business information. |
| Privacy | P1–P8 | 18 | Personal information is collected, used, retained, disclosed, and disposed of as you committed. | You handle personal information and a buyer needs assurance over its lifecycle in the report. |
| Total | 61 |
Every category’s criteria set also includes CC1–CC9, so the series column shows only what each category adds. Counts follow TSP Section 100 and exclude the headings numbered P1.0 to P8.0 that open each Privacy series. Sources that report “eight privacy criteria” are counting series, not criteria. To see where the criteria fit in a full audit, read the SOC 2 compliance guide. For what the audit needs beyond the criteria, such as the system description and management assertion, see what SOC 2 requires.
The Criteria Map: Every Series and What It Covers
Criteria are numbered by series and position, so CC6.1 is the first criterion in the CC6 series. The AICPA writes each one as an outcome rather than a control. The summaries below paraphrase them; the AICPA text controls.
Security: the 33 Common Criteria
| Series | Criteria | Count | What it covers |
|---|---|---|---|
| CC1 Control environment | CC1.1–CC1.5 | 5 | Integrity and ethics, board oversight, reporting lines, hiring and keeping competent people, accountability for controls. |
| CC2 Information and communication | CC2.1–CC2.3 | 3 | Using quality information, communicating responsibilities internally, and communicating with outside parties. |
| CC3 Risk assessment | CC3.1–CC3.4 | 4 | Clear objectives, identifying and analyzing risks, fraud risk, and assessing significant changes. |
| CC4 Monitoring activities | CC4.1–CC4.2 | 2 | Ongoing and separate evaluations of controls, and reporting deficiencies to the people who can fix them. |
| CC5 Control activities | CC5.1–CC5.3 | 3 | Choosing controls that reduce risk, general technology controls, and deploying them through policies and procedures. |
| CC6 Logical and physical access | CC6.1–CC6.8 | 8 | Access security, registering and removing users, role-based access, physical access, asset disposal, outside threats, data in transit, malicious software. |
| CC7 System operations | CC7.1–CC7.5 | 5 | Detecting configuration changes and new vulnerabilities, monitoring for anomalies, evaluating events, incident response, recovery. |
| CC8 Change management | CC8.1 | 1 | Authorizing, designing, testing, approving, and implementing changes to infrastructure, data, software, and procedures. |
| CC9 Risk mitigation | CC9.1–CC9.2 | 2 | Mitigating business-disruption risk and managing vendor and business-partner risk. |
You will see both 17 and 33 quoted for the Common Criteria. CC1.1 through CC5.3 are the 17 criteria aligned one-to-one with the 17 principles of the COSO internal control framework; each cites its COSO principle number in the AICPA text. CC6 through CC9 add 16 supplemental criteria for access, operations, change management, and risk mitigation. Together that is 33. The governance half is why a Security-only audit tests more than technical settings.
For the CC6 and CC7 criteria in detail, see SOC 2 security controls. For CC1–CC5 and the COSO structure, see the criteria map above.
Availability, Processing Integrity, and Confidentiality
| Series | Criteria | Count | What it covers |
|---|---|---|---|
| A1 Availability | A1.1–A1.3 | 3 | Monitoring capacity (A1.1); environmental protections, backups, and recovery infrastructure (A1.2); testing recovery plan procedures (A1.3). |
| PI1 Processing integrity | PI1.1–PI1.5 | 5 | Quality information about processing specifications (PI1.1); controls over inputs (PI1.2), processing (PI1.3), delivery of output (PI1.4), and storage of inputs, in-process items, and outputs (PI1.5). |
| C1 Confidentiality | C1.1–C1.2 | 2 | Identifying and maintaining confidential information (C1.1) and disposing of it when it is no longer needed (C1.2). |
Two limits in the AICPA text affect scoping:
- Availability sets no uptime number. The category does not by itself set a minimum performance level. Your own commitments set the bar, and A1 tests the capacity, backup, and recovery controls behind them.
- Processing Integrity is usually assessed for one system or function, not the whole company. A billing engine can be in scope while the rest of the business is not.
Guide for the Processing Integrity series: Processing Integrity. For an example control and its evidence under every criterion in these series, filter the SOC 2 controls library to the categories you scope in.
Privacy: the 18 criteria in P1–P8
| Series | Criteria | Count | What it covers |
|---|---|---|---|
| P1 Notice and communication | P1.1 | 1 | Telling data subjects about privacy practices and keeping the notice current. |
| P2 Choice and consent | P2.1 | 1 | Communicating the choices people have and obtaining explicit consent where it is required. |
| P3 Collection | P3.1–P3.2 | 2 | Collecting personal information consistent with your privacy objectives, with consent obtained before collection where required. |
| P4 Use, retention, and disposal | P4.1–P4.3 | 3 | Limiting use to identified purposes, retaining information as committed, and disposing of it securely. |
| P5 Access | P5.1–P5.2 | 2 | Giving verified data subjects access to their information and correcting it on request. |
| P6 Disclosure and notification | P6.1–P6.7 | 7 | Consent before disclosure, records of authorized and unauthorized disclosures, vendor commitments on privacy and breach notice, notifying affected people and regulators, and an accounting of disclosures on request. |
| P7 Quality | P7.1 | 1 | Keeping personal information accurate, current, complete, and relevant. |
| P8 Monitoring and enforcement | P8.1 | 1 | Handling inquiries, complaints, and disputes, and monitoring compliance. |
A criterion that cannot apply to your service can be marked not applicable. The AICPA’s own example is P3.1 for a service that does not collect personal information directly from the people it concerns.
How to Read the Criteria
- Criteria state outcomes, not controls. CC6.1 says you implement logical access security over protected assets. It does not say how. You and your CPA firm decide which controls meet it, which is why two companies with the same scope can run different control sets.
- Points of focus are guidance, not a checklist. Each criterion carries points of focus. The AICPA says using the criteria does not require assessing whether each one is addressed, and management may adapt them.
- A category is the unit of scope. For each category in the report, the auditor usually addresses all of its criteria. You cannot drop A1.3 by choice; a criterion is left out only when it does not apply.
- The 2022 revision changed guidance, not criteria. Privacy points of focus now distinguish data controllers from processors, and privacy points of focus were added to the Common Criteria for engagements that include Privacy.
- Old names still circulate. Before the 2017 criteria, the five categories were the Trust Services Principles. Questionnaires and older reports use that term; the five are the same.
The Proposed 2027 Criteria
The AICPA has released an exposure draft of proposed 2027 SOC 2 Trust Services Criteria, dated 27 October 2026. Comments are requested by 15 January 2027. If issued as final, the criteria apply to engagements beginning on or after 31 December 2027, and early implementation would be permitted.
The draft has 50 criteria against today’s 61, and 20 common criteria against 33. Numbers move: change management goes from CC8.1 to three CC7 criteria, and vendor management from CC9.2 to CC8.1. It adds points of focus on AI to many criteria, not AI-specific criteria.
It can change before it is final. SOC 2 reports use the 2017 criteria on this page today; ask your CPA firm which criteria your engagement will use. Our explainer of the proposed 2027 criteria has the detail.
Which Categories Does Your Report Need?
Start with Security, then add Availability, Processing Integrity, Confidentiality, or Privacy only when it matches a commitment your customers rely on. Each added category adds criteria to test, evidence to keep, and audit hours to pay for, so a category no buyer asks for raises cost without supporting a sale.
| Customer promise or data type | Category to consider | Evidence buyers and auditors may expect | Usually leave it out when |
|---|---|---|---|
| “The service will meet this uptime or recovery target.” | Availability | Capacity monitoring, backups, recovery test results, measured RTO/RPO | You make no material availability commitment beyond Security controls |
| “Transactions or calculations will be complete, accurate, timely, and authorized.” | Processing Integrity | Input validation, exception handling, reconciliation, processing tests | Your product stores or displays data but does not make a processing-accuracy promise |
| “We will protect and securely dispose of designated business information.” | Confidentiality | Classification, access restrictions, protection measures, deletion evidence | Contracts do not designate information as confidential beyond the Security scope |
| “We collect and use personal information according to stated privacy commitments.” | Privacy | Notice, consent where applicable, data inventory, access/correction, retention, disclosure, monitoring | A separate privacy program meets obligations and customers do not require the Privacy category in the report |
This is a scoping prompt, not legal advice or a substitute for the CPA firm’s engagement decision. Three practical points:
- Ask buyers, then read contracts. Security questionnaires and MSAs show which categories your target customers expect. Across the 73 SOC 2 reports in CBIZ’s 2024 benchmark, every report covered Security, 75.3% added Availability, 64.4% Confidentiality, 13.7% Processing Integrity, and 6.8% Privacy.
- Added categories reuse Security evidence. The Common Criteria sit under every category, so much of the evidence already exists. The new work is the category’s own series: 3, 5, 2, or 18 criteria.
- Timing matters for Type 2. A Type 2 report tests controls over a period, so a category added partway through has no operating history for the earlier months. Plan for it to appear in full in the next period, or ask your CPA firm about a Type 1 on the expanded scope first.
To set the system boundary before you pick categories, see SOC 2 scope determination. For how scope drives the number, see what a SOC 2 audit costs.
What Each Optional Category Adds in Controls
The criteria state outcomes, and a company meets them with controls. Our SOC 2 controls library holds 82 example controls and maps every one of the 61 criteria to at least one, so it shows how much of an optional category a Security-only scope already covers. The mapping is ours, not the AICPA’s, and your CPA firm may test different controls against the same criteria.
| Category | Criteria | Controls a Security-only scope already contains | Controls the category adds |
|---|---|---|---|
| Availability | A1.1 to A1.3 | PE-02 (hosting providers’ SOC 2 reports), BC-01 (encrypted, monitored backups) | BC-02 (a recovery plan with targets), BC-03 (an annual recovery test), BC-04 (capacity monitoring) |
| Confidentiality | C1.1 and C1.2 | GV-01 (confidentiality agreements), DP-01 (encryption at rest), CM-05 (customer data kept out of test environments), AM-02 (media wiped before reuse), AIM-02 (AI provider data settings) | DP-02 (data classification and handling rules), DP-03 (deletion when retention ends) |
| Processing Integrity | PI1.1 to PI1.5 | None | PRC-01 to PRC-06: documented processes, input validation, job monitoring, change testing, output reconciliation, and protected records |
| Privacy | P1.1 to P8.1 | None | PV-01 to PV-10: privacy notice, consent, data inventory, retention and deletion, access and correction requests, disclosures, vendor terms, breach handling, and complaints |
Confidentiality sits mostly on work that Security already requires. Encryption, test-data rules, media disposal, AI provider data settings and the confidentiality agreement each answer both a C1 criterion and a Common Criterion, so classification and deletion are the new work. Availability is split: backups and the review of hosting providers’ SOC 2 reports are shared, while a written recovery plan with targets, a recovery test and capacity monitoring are new. No Security control in the library answers a Processing Integrity or Privacy criterion, so each of those categories is a block of new work. Privacy is the larger block, and most of it concerns requests from people and your disclosures to third parties rather than technical settings.
Confidentiality vs Privacy: Which One Do You Need?
Confidentiality (C1.1–C1.2) protects information designated confidential, such as trade secrets, contract terms, and M&A data, and includes its disposal. Privacy (18 criteria across P1–P8) applies only to personal information and covers its lifecycle from notice and consent through disclosure and disposal. Confidentiality is driven by contracts and NDAs. Privacy is driven by privacy commitments, applicable law, and what customers need in the report.
| Aspect | Confidentiality (C1.1–C1.2) | Privacy (P1–P8) |
|---|---|---|
| Protects | Information your business designates confidential. | Personal information about individuals. |
| Examples | Trade secrets, contract terms, M&A details, internal financials. | Names, emails, addresses, health data. |
| Primary driver | Contracts and NDAs. | Privacy commitments, applicable law, and customer expectations. |
| Size | 2 criteria. | 18 criteria across 8 series. |
Confidential information can include personal information, so the two overlap. Privacy is the larger lift: 18 criteria against 2. Include it when a customer needs assurance over how you handle personal information, such as notice, consent, access, and breach notification, in the report itself. Many companies meet customer privacy needs through Security and Confidentiality controls plus a standalone privacy program, and add the Privacy category when a buyer requires it.
Regulatory context: Privacy laws and the EU AI Act can create obligations outside a SOC 2 engagement. They do not by themselves require you to scope the Privacy category. Map the laws and contracts that apply to each data flow with counsel, then decide with the CPA firm whether the Privacy category adds useful assurance. For AI systems placed on the EU market, check the European Commission’s current AI Act timeline rather than relying on a static deadline summary here.
Frequently Asked Questions
What are the 5 SOC 2 Trust Services Criteria?
The five categories are Security, Availability, Processing Integrity, Confidentiality, and Privacy. The AICPA defines 61 criteria across them in TSP Section 100 (2017 criteria with revised points of focus, 2022): 33 Common Criteria (CC1–CC9) for Security, 3 for Availability (A1), 5 for Processing Integrity (PI1), 2 for Confidentiality (C1), and 18 for Privacy (P1–P8).
Which Trust Services Criteria are mandatory for SOC 2?
No category is mandatory, but every SOC 2 report covers Security’s 33 criteria, the Common Criteria (CC1–CC9), because they are part of the criteria set for every category. The company that engages the auditor chooses one or more categories. Nearly every report includes Security: the AICPA calls an examination without it uncommon, and an auditor may decline one whose scope would mislead readers. Availability, Processing Integrity, Confidentiality, and Privacy are added based on your service commitments and what customers require.
What is the difference between Confidentiality and Privacy in SOC 2?
Confidentiality (criteria C1.1–C1.2) protects information designated as confidential, such as trade secrets and contract data, including its secure disposal. Privacy (18 criteria across the P1–P8 series) applies only to personal information and covers its lifecycle: notice, choice and consent, collection, use, retention, disposal, access, disclosure, quality, and monitoring.
Are the Trust Services Criteria the same as the Trust Services Principles?
They are the same five categories under an older name. Documents and questionnaires written before the 2017 criteria call them the Trust Services Principles. The five names (Security, Availability, Processing Integrity, Confidentiality, Privacy) carry over unchanged.
Do I have to meet every point of focus in the Trust Services Criteria?
No. Points of focus are guidance under each criterion, not requirements. The AICPA says using the criteria does not require assessing whether each point of focus is addressed, and management may adapt them. The criteria themselves are outcomes: for each category in scope, the auditor usually addresses all of that category’s criteria.
Are the Trust Services Criteria changing?
A revision is proposed, not final. In October 2026 the AICPA released an exposure draft of 2027 criteria with 50 criteria against 61. Current SOC 2 reports still use the 2017 criteria described on this page. See our explainer of the proposed 2027 criteria for the dates and changes.
To compare firms by scope, pricing, and timeline, start with the SOC 2 auditor directory.
More in SOC 2 Basics