SOC 2 Trust Services Criteria explained: Security, Availability, Processing Integrity, Confidentiality and Privacy

How the Trust Services Criteria are organised

The AICPA's Assurance Services Executive Committee issues the Trust Services Criteria for attestation and consulting engagements; SOC 2 is their best-known use. The current edition is the 2017 text, reissued in 2022 with new and revised points of focus but unchanged criteria.

There are five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. The Security criteria are called the common criteria because they apply whatever else is in scope, and no SOC 2 examination leaves them out; they run in nine groups, CC1 to CC9. Each optional category adds criteria of its own: A1 for Availability, PI1 for Processing Integrity, C1 for Confidentiality, and eight groups, P1 to P8, for Privacy. A report on Security and Confidentiality is therefore evaluated against CC1 to CC9 plus C1.

CC1 to CC5 mirror the five components of the COSO internal control framework and its seventeen principles; CC6 to CC9 add criteria on access, operations, change and risk mitigation. Under each criterion sit points of focus: guidance on features a control might include, not requirements.

Security: the common criteria, CC1 to CC9

Security means protecting information and systems from unauthorised access, disclosure and damage. In a Type 1 the CPA firm evaluates design as at a single date; a Type 2 also tests operating effectiveness, sampling evidence across the period.

• CC1 Control environment. Do integrity, oversight and accountability start at the top? Management oversight, reporting lines, screened and competent staff, and a signed code of conduct.
• CC2 Communication and information. Do the people who run controls get the information they need, and do customers and suppliers know your commitments and how to report a problem?
• CC3 Risk assessment. Are risks to your objectives, fraud included, identified, analysed and revisited after significant change? The risk register and its review history carry this group.
• CC4 Monitoring activities. Do ongoing checks or separate evaluations confirm that controls still work, with deficiencies reported and put right?
• CC5 Control activities. Are controls, technology controls included, selected to address the risks and deployed through policies and procedures people follow?
• CC6 Logical and physical access controls. Authentication, access granted and removed, access reviews, encryption, malware protection and physical entry; expect samples of joiners, movers and leavers.
• CC7 System operations. Detecting vulnerabilities and anomalies, then handling incidents from identification to recovery; scan results, alerts and the incident register are reviewed.
• CC8 Change management. Are changes to infrastructure, data, software and procedures authorised, tested and approved before implementation? A sample of changes is traced to tickets and approvals.
• CC9 Risk mitigation. Planning for business disruption and managing vendor and business-partner risk, including a review of their assurance reports.

The four optional categories and what each adds

Availability (A1)

The criteria set no uptime figure; your own commitment is the target. Expect capacity, backup and recovery to be examined, and recovery plans to be tested, not just written.

Processing Integrity (PI1)

This category suits services whose output is the product, such as payroll, claims or billing, and follows data from inputs through to outputs and storage.

Confidentiality (C1)

It applies to information you have designated or agreed to keep confidential, from identifying and protecting it to disposing of it as committed.

Privacy (P1 to P8)

It follows personal information through eight groups: notice; choice and consent; collection; use, retention and disposal; access; disclosure and notification; quality; and monitoring and enforcement. Each is judged against what your privacy notice told individuals.

Choosing the categories: when to add each one

Management decides which categories an examination covers. Base the decision on promises already made in master agreements, service level agreements, data processing terms, security questionnaires and your privacy notice. Omitting a category your contracts rely on weakens the report; adding one you cannot yet support puts exceptions in front of the clients you meant to reassure.

• Availability when customers cannot operate without your service, or you commit to uptime or recovery times.
• Confidentiality when contracts or non-disclosure terms require client information to be protected and returned or destroyed.
• Processing Integrity when customers rely on your system's output without re-checking it, as with payroll, billing or payments.
• Privacy when you collect personal information from individuals under your own notice. If you process it only on clients' instructions, Security with Confidentiality is often the closer fit; discuss it with the CPA firm.

A category left out of the first report can join a later period once its controls have run long enough to be examined.

How the criteria relate to ISO/IEC 27001 Annex A

ISO/IEC 27001:2022 arranges its 93 Annex A controls in four themes: organisational, people, physical and technological. The criteria are outcomes, not a control list, but the overlap is wide.

• CC1 to CC5 match the main clauses of ISO/IEC 27001 more than Annex A: leadership, risk assessment and treatment, communication, internal audit and management review, with the people theme adding screening, employment terms and awareness.
• CC6 to CC8 sit mostly in the technological theme, from authentication and logging to vulnerability, development and change controls; the physical theme covers premises and equipment, and the organisational theme covers incident management.
• CC9 aligns with the organisational controls on suppliers, cloud services and continuity; A1 with capacity management, backup, redundancy and ICT readiness; C1 with classification, labelling, transfer and deletion of information.
• P1 to P8 reach well beyond the single Annex A control on privacy and protection of PII. PI1 has the thinnest counterpart: Annex A reaches it only through application security and development controls.

Holding ISO/IEC 27001 gives you much of the control design, but a Type 2 samples how each control operated across a period, against the criteria rather than your Statement of Applicability. The guide SOC 2 vs ISO/IEC 27001: which one, or both? covers the decision.

Where organisations misread the criteria

• Treating points of focus as requirements. A control per point of focus bloats the description and invites exceptions; design to the criterion and use the points of focus to find gaps.
• Borrowing control wording. A template control promising quarterly access reviews will be tested quarterly, whether or not your team works that way.
• Leaving CC3 and CC4 until last. Controls should answer assessed risks and be monitored as they run; a risk assessment written after the controls, and monitoring that starts at fieldwork, show the opposite.

SOC 2 Trust Services Criteria: questions buyers ask