SOC 2 Trust Service Criteria Explained
The Trust Services Criteria define what your SOC 2 audit actually tests. Security is mandatory; the other four are optional. Here is what each one covers and how to choose.
Overview of the Five Criteria
The Trust Services Criteria (TSC) are AICPA-defined frameworks that organize SOC 2 audits. Five categories exist. Security is the foundation and is required for every SOC 2 report. The other four are optional and selected based on your business and customer requirements.
- Security (CC): Common Criteria. Required.
- Availability (A): Optional. System uptime and recovery.
- Confidentiality (C): Optional. Protection of confidential information.
- Processing Integrity (PI): Optional. Accuracy and completeness of processing.
- Privacy (P): Optional. Personal information handling.
Each criterion contains specific points of focus. Security alone has 33 points of focus across nine common criteria sections. Adding criteria adds points of focus and audit work.
Pick criteria based on customer demand, not internal preference. The SOC 2 framework reference details the points of focus for each.
Security: The Foundation
Security is the Common Criteria (CC) and is mandatory for every SOC 2 report. It is organized into nine sections (CC1 through CC9) covering everything from control environment to incident response.
Key sections:
- CC1: Control environment, governance, board oversight
- CC2: Communication and information
- CC3: Risk assessment
- CC4: Monitoring activities
- CC5: Control activities (segregation of duties, etc.)
- CC6: Logical and physical access controls
- CC7: System operations (vulnerability management, monitoring)
- CC8: Change management
- CC9: Risk mitigation (vendor management, business continuity)
If you only do Security, your audit covers everything in CC1-CC9. Most companies start here and expand later.
Availability: When Uptime Matters
Availability adds three additional criteria (A1.1, A1.2, A1.3) covering system uptime, recovery, and capacity management. Add Availability if your customer contracts include uptime SLAs or if your service is mission-critical.
What Availability tests:
- Capacity planning and monitoring
- Backup and recovery procedures with documented RTO and RPO
- Disaster recovery testing and results
- Incident response with availability impact tracking
- Change management impact on availability
Availability requires you to define what "available" means for your service. Is it the API uptime? The marketing site? The admin console? The system description must spell this out, and the auditor will test against your stated definition.
For most B2B SaaS, Availability is worth including. It signals operational maturity and addresses common procurement questions.
Confidentiality and Processing Integrity
Confidentiality (C1.1, C1.2) covers protection of information designated confidential. This goes beyond Security's logical access controls to include encryption at rest and in transit, key management, data classification, and confidentiality agreements with employees and vendors.
Add Confidentiality if customers contractually designate data as confidential and you have obligations beyond standard data protection. Most B2B SaaS handling customer data includes Confidentiality.
Processing Integrity (PI1.1 through PI1.5) covers whether system processing is complete, accurate, timely, and authorized. It is most relevant for transaction processing systems: payment platforms, financial services, healthcare claims, billing systems.
If your service does mathematical or transactional processing where accuracy matters to customers, Processing Integrity is worth including. If your service is content storage or collaboration, Processing Integrity is usually not relevant and adds audit cost without customer benefit.
Privacy: When Personal Information Is in Scope
Privacy (P1 through P8) is the most extensive optional criterion. It covers the entire lifecycle of personal information: notice, choice, collection, use, retention, access, disclosure, security, quality, and monitoring.
The eight Privacy sections:
- P1: Privacy notice and communication
- P2: Choice and consent
- P3: Collection
- P4: Use, retention, and disposal
- P5: Access
- P6: Disclosure to third parties
- P7: Quality
- P8: Monitoring and enforcement
Add Privacy if you process personal information subject to laws like CCPA, GDPR, or sector-specific privacy rules, and your customers want assurance you handle that data properly. The control set overlaps significantly with privacy compliance programs you may already run.
Privacy adds 30-50% to audit fees due to the breadth of testing. For most B2B SaaS, alternative attestations like ISO 27701 or specific privacy frameworks may be a better fit. For consumer-facing services, Privacy in SOC 2 is worth the cost.
Frequently Asked Questions
Related Articles
SOC 2 Type I vs Type II
Type I tests control design at a point in time. Type II tests operating effectiveness across an audit period. Here is what each one proves and which one matters to your customers.
SOC 2 Compliance Checklist
A SOC 2 audit covers controls across the Trust Service Criteria you select. This checklist walks through every step from scoping to report issuance.
SOC 2 Evidence Collection Best Practices
Audit speed and quality depend on evidence quality. These patterns let you collect evidence continuously, name it consistently, and produce it on demand during fieldwork.