Every SOC 2 report is built on the Trust Services Criteria (TSC), a framework published by the AICPA. These criteria define what auditors evaluate and what your controls must accomplish. Choosing the right criteria shapes the scope, cost, and value of your SOC 2 report, so it is worth understanding each one before you begin.
The Five Trust Services Criteria
1. Security (Required)
Security is the foundation of every SOC 2 report and is often called the Common Criteria. It covers how systems and data are protected against unauthorized access, disclosure, and damage. Areas evaluated include:
- Control environment, governance, and risk assessment
- Communication of security responsibilities
- Logical and physical access controls
- System operations, including monitoring and incident response
- Change management
- Risk mitigation, including vendor management
Even if you only include Security, a SOC 2 report covers a broad range of controls.
2. Availability
Availability addresses whether systems are operational and accessible as committed in your agreements with customers. It is common for SaaS providers, hosting companies, and managed service providers with uptime commitments. Controls typically include capacity monitoring, performance management, backup, disaster recovery, and business continuity testing.
3. Processing Integrity
Processing Integrity evaluates whether system processing is complete, valid, accurate, timely, and authorized. It applies to businesses whose services depend on correct processing, such as payroll, billing, claims processing, or financial transaction platforms. Controls include input validation, error handling, reconciliation, and output review.
4. Confidentiality
Confidentiality covers information designated as confidential, such as business plans, intellectual property, contracts, and customer data subject to non-disclosure agreements. Controls focus on identifying confidential information, restricting access, encrypting data, and securely disposing of it when no longer needed.
5. Privacy
Privacy addresses how personal information is collected, used, retained, disclosed, and disposed of in line with your privacy notice and applicable principles. It is most relevant to businesses that collect personal information directly from individuals. Privacy controls include notice, consent, access requests, data minimization, and retention.
How To Choose Which Criteria To Include
Security is mandatory. The others should reflect the commitments you make to customers. Ask:
- Do we promise uptime or service levels? Consider Availability.
- Do customers rely on us to process data accurately? Consider Processing Integrity.
- Do we handle confidential business information for clients? Consider Confidentiality.
- Do we collect personal information from individuals? Consider Privacy.
Review customer contracts and security questionnaires to see what they actually request. Many companies start with Security and Availability or Security and Confidentiality, then expand later.
Why Scope Matters
Each added criterion increases the number of controls auditors test and the evidence you must maintain. Including criteria customers do not need adds cost without benefit. Leaving out criteria customers expect can make your report less useful in sales conversations.
Controls That Support Every Criterion
Regardless of scope, certain operational controls appear repeatedly in SOC 2 audits:
- Multi-factor authentication and access reviews
- Endpoint protection and vulnerability management
- Centralized logging and monitoring
- Encrypted, tested backups
- Documented incident response
- Security awareness training
- Vendor risk reviews
Managed IT and security services that run these controls consistently make SOC 2 audits far less stressful.
Start With A Readiness Review
A readiness assessment helps confirm which criteria fit your business and how close your current controls are to meeting them.
CTS Companies helps Michigan businesses scope and prepare for SOC 2 compliance, running the technical controls behind each Trust Services Criterion. Talk to an expert about your SOC 2 scope.