---
title: "SOC 2 Trust Services Criteria: the five categories, the common criteria and the controls that meet them"
canonical: https://www.grcmana.io/vault/soc-2/trust-services-criteria
published: 2024-05-15
updated: 2026-10-23
author: "Harry West"
framework: "SOC 2"
control: "Guide SOC 2 Trust Services Criteria: the five categories, the common criteria and the controls that meet them"
journeyStage: fundamentals
---

# SOC 2 Trust Services Criteria: the five categories, the common criteria and the controls that meet them

## Key takeaways

The SOC 2 Trust Services Criteria are the AICPA criteria a SOC 2 examination is tested against, grouped into five categories with 61 criteria in all. The 33 common criteria are always tested, and the other four categories are added only when customer commitments call for them. Criteria say what to achieve; your firm designs the controls that achieve it.

- **Common criteria** — The 33 criteria in series CC1 to CC9 that every SOC 2 examination tests. CC1 to CC5 follow COSO's 17 principles; CC6 to CC9 cover access, operations, change and risk mitigation.
- **Points of focus** — Notes the AICPA gives under each criterion to guide how controls are designed and judged. They are guidance, not requirements: nobody expects you to show that each one is met.
- **Controls vs criteria** — Criteria set what must be achieved; controls are what your firm designs to achieve it. There is no official SOC 2 controls list; auditors test your controls against the criteria.
- **Optional categories** — Availability adds 3 criteria, Processing Integrity 5, Confidentiality 2 and Privacy 18. Add a category only when a contract, service level or questionnaire answer commits you to it.

Your US prospect's security questionnaire asks which SOC 2 Trust Services Criteria your report covers, and nobody in the business has decided yet. Choose too few and the report misses what your contract promises. Choose too many and you pay for testing no customer asked for.

This guide is for founders, COOs and security leads at UK B2B tech firms with 25 to 100 staff, many already holding ISO 27001. It indexes every category and criterion series in one place. It shows how the common criteria are built, splits criteria from controls, and gives you a rule for what goes in scope.

## What are the SOC 2 Trust Services Criteria?

The SOC 2 Trust Services Criteria are the AICPA criteria a SOC 2 examination is tested against. They fall into five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security, made up of the common criteria, is always in scope. The other four are added only when your promises to customers call for them.

For what SOC 2 is and why buyers ask for it, start with our [SOC 2 overview](https://www.grcmana.io/vault/soc-2). This page goes one level down, into the criteria themselves.

The criteria are published as the AICPA's [2017 Trust Services Criteria, with points of focus revised in 2022](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022). The AICPA's Assurance Services Executive Committee set them for attestation and consulting engagements. In the AICPA's [mapping of the criteria to ISO 27001](https://www.aicpa-cima.com/resources/download/mapping-2017-trust-services-criteria-to-iso-27001), it describes them as "outcome-based": each criterion names a result your system must reach and leaves the method to you.

Each category's full set of criteria includes the common criteria. Security is made of them alone. So the auditor tests the common criteria in every SOC 2 examination, whatever else is in scope.

| Category | What it covers, in plain terms | Criteria assessed |
| --- | --- | --- |
| Security | Keeping systems and information safe from unauthorised access, leaks and damage | The 33 common criteria (CC1 to CC9) |
| Availability | Whether your service is up and usable to the level you committed to | Common criteria plus 3 (A1 series) |
| Processing Integrity | Whether customers can rely on what your system produces from their data | Common criteria plus 5 (PI1 series) |
| Confidentiality | Keeping restricted the information your contracts mark as confidential, and getting rid of it when they say | Common criteria plus 2 (C1 series) |
| Privacy | Treating people's personal data as your privacy notice promises, from first contact to deletion | Common criteria plus 18 (P1 to P8 series) |

## How are the SOC 2 common criteria organised?

The SOC 2 common criteria run in nine series, CC1 to CC9, with 33 criteria in total. CC1 to CC5 follow the 17 principles of COSO's 2013 Internal Control – Integrated Framework, one criterion per principle. CC6 to CC9 are supplemental series covering access, system operations, change management and risk mitigation, which is where the security-specific work sits.

[COSO's Internal Control – Integrated Framework](https://www.coso.org/internal-control) was first issued in 1992 and refreshed in 2013. The [Journal of Accountancy's report on the 2013 update](https://www.journalofaccountancy.com/news/2013/may/20137970/) sets out its 17 principles across five parts: control environment, risk assessment, control activities, information and communication, and monitoring.

The AICPA lined up the Trust Services Criteria with those 17 principles. It then added extra criteria for the controls a service firm runs day to day. Those extra criteria are what make SOC 2 about information security.

More than half of the common criteria are about how the company is run, not how its servers are configured.

The table indexes every series in the 2017 criteria. The counts are ours, taken from the AICPA's criteria document; the descriptions summarise each area in our own words.

| Series | Category | Topic | Criteria | What the series is about (our summary) |
| --- | --- | --- | --- | --- |
| CC1 | Security (common) | Control environment | 5 | Oversight by leadership, ethics, structure, competence and accountability for security |
| CC2 | Security (common) | Communication and information | 3 | Good information for running controls, and clear messages inside and outside the firm |
| CC3 | Security (common) | Risk assessment | 4 | Setting objectives, then finding and weighing the risks to them, including fraud and change |
| CC4 | Security (common) | Monitoring of controls | 2 | Checking that controls work and fixing what does not |
| CC5 | Security (common) | Control activities | 3 | Choosing controls, including technology controls, and putting them into policy and practice |
| CC6 | Security (common) | Logical and physical access | 8 | Who and what can reach systems and data, and how access is granted, changed and removed |
| CC7 | Security (common) | System operations | 5 | Spotting problems and attacks, responding to incidents and recovering |
| CC8 | Security (common) | Change management | 1 | Making changes to systems and software in a controlled way |
| CC9 | Security (common) | Risk mitigation | 2 | Planning for disruption, and managing risk from suppliers and partners |
| A1 | Availability | Availability | 3 | Capacity, resilience of the environment, and recovery that has been tested |
| PI1 | Processing Integrity | Processing integrity | 5 | Correct inputs, processing, outputs and stored data, against defined specifications |
| C1 | Confidentiality | Confidentiality | 2 | Identifying confidential information, protecting it and disposing of it |
| P1 | Privacy | Notice and communication of objectives | 1 | Telling people what you do with their personal data |
| P2 | Privacy | Choice and consent | 1 | Giving people choices and recording what they agreed to |
| P3 | Privacy | Collection | 2 | Collecting only what your stated purposes need |
| P4 | Privacy | Use, retention and disposal | 3 | Using and keeping personal data only as long as the purpose needs |
| P5 | Privacy | Access | 2 | Letting people see and correct their own data |
| P6 | Privacy | Disclosure and notification | 7 | Sharing data with third parties properly, and notifying breaches |
| P7 | Privacy | Quality | 1 | Keeping personal data accurate and up to date |
| P8 | Privacy | Monitoring and enforcement | 1 | Handling complaints and checking privacy practice is followed |

The full set comes to 61 criteria. A Security-only examination uses 33 of them.

## Are the SOC 2 points of focus requirements?

No. Points of focus are the AICPA's notes under each criterion on what a well-designed control might cover. They help management shape controls and help auditors judge them. Some will not fit your firm, and the AICPA says outright that you are not expected to show each one is met. The criterion is the requirement; points of focus are guidance.

The idea comes from COSO. In its framework, points of focus help a firm judge whether a principle is in place and working. The Journal of Accountancy's [report on aligning controls with the COSO principles](https://www.journalofaccountancy.com/news/2013/dec/20139279/) notes that not every point of focus needs to be present at every organisation.

The AICPA revised the SOC 2 points of focus in 2022. The criteria themselves are still the 2017 set.

Use the points of focus two ways:

- **When you design a control,** as a prompt list for what the criterion is getting at.
- **When you prepare for fieldwork,** as a preview of the questions an auditor may ask.

Do not build a control for every point of focus. A control with no risk behind it adds evidence to collect and a test that can fail, without making the service any safer.

## What is the difference between SOC 2 controls and the Trust Services Criteria?

The Trust Services Criteria say what must be achieved; controls are what your firm does to achieve it. The auditor tests your controls against the criteria. There is no official SOC 2 controls list. Management designs controls for its own system and risks, so two firms can meet the same criterion in quite different ways.

The AICPA's description of the criteria starts from management understanding the risks that could stop the system meeting its objectives. Controls follow from those risks. The question of a minimum set of common controls comes up often. AICPA staff addressed it in their [2020 FAQs on SOC 2 and SOC 3 engagements](https://www.journalofaccountancy.com/news/2020/dec/aicpa-issues-faqs-on-soc-2-soc-3-engagements/).

A controls list copied from another firm's report describes their system, not yours.

The table gives examples of controls that typically meet each common criteria series at a 25 to 100 person software firm. These are our practical examples, not AICPA text, and your own set should come from your risk assessment.

| Series | Example controls (GRCMANA examples) |
| --- | --- |
| CC1 Control environment | Security reported to the leadership team or board with minuted decisions; a code of conduct acknowledged on joining; pre-employment screening; a named security owner |
| CC2 Communication and information | Policies published to staff with read receipts; security commitments set out in contracts and the trust centre; a channel for raising concerns |
| CC3 Risk assessment | A risk register with owners, reviewed at least yearly and after significant change, with fraud and supplier risks included |
| CC4 Monitoring of controls | Internal control reviews on a schedule; deficiencies logged and tracked to closure |
| CC5 Control activities | A policy set with owners and review dates; standards for how technology controls are configured |
| CC6 Logical and physical access | Single sign-on with multi-factor authentication; joiner, mover and leaver steps; quarterly access reviews; encryption in transit and at rest |
| CC7 System operations | Vulnerability scanning with fix deadlines; central logging and alerting; an incident response plan that is rehearsed |
| CC8 Change management | Peer-reviewed pull requests; approval before production deployment; an emergency change route that is reviewed afterwards |
| CC9 Risk mitigation | Supplier reviews that include their assurance reports; a business continuity plan with a tested recovery |

Write each control as an outcome a tester can sample, with an owner and a frequency, rather than a tool name. Recording which criteria each control meets, in a controls matrix, is covered in our [SOC 2 documentation guide](https://www.grcmana.io/vault/soc-2/documentation).

## Which Trust Services Criteria categories should you add beyond Security?

Add a category when you have made a promise in that area that a customer can hold you to. Examples are an uptime service level for Availability, accuracy duties for Processing Integrity, confidentiality clauses for Confidentiality, or a privacy notice customers rely on for Privacy. If no contract, service level or questionnaire answer creates the promise, leave the category out.

A five-step rule keeps the decision honest:

1. **List your commitments.** Pull them from your contracts, data processing terms, service levels, questionnaire answers and trust centre.
2. **Sort each one into a category.** An uptime figure is Availability; a promise to delete customer files at contract end is Confidentiality.
3. **Ask the customer what they need.** A prospect asking for "SOC 2" often needs Security alone; ask before you assume.
4. **Price the addition.** Each category brings more criteria, more controls to evidence, more samples and more places for an exception to appear.
5. **Revisit it every year.** New contracts create new commitments, and the scope should follow them.

Every category in scope is a promise, in writing, to every reader of the report.

| Category | Add it when | What it adds | Typical extra controls (our examples) |
| --- | --- | --- | --- |
| Availability | You publish an uptime service level, or customers run their operations on your platform | 3 criteria | Capacity monitoring; backups with restore tests; a disaster recovery plan exercised each year |
| Processing Integrity | Customers rely on your outputs being correct, such as payments, payroll or calculations | 5 criteria | Input validation; reconciliations; output checks; handling and correcting processing errors |
| Confidentiality | Contracts define information you must restrict and destroy on request or at exit | 2 criteria | Data classification; a retention schedule; secure deletion with evidence |
| Privacy | You decide how personal data is collected and used, and customers need assurance on that | 18 criteria | Privacy notices; consent records; handling data subject requests; breach notification |

We recommend starting with Security plus only the categories a signed commitment requires, then adding others when a customer's contract asks for them. The categories you choose are named in the scope of your system, which our [SOC 2 system description guide](https://www.grcmana.io/vault/soc-2/system-description) covers.

## What is the difference between Confidentiality and Privacy in SOC 2?

Confidentiality protects whatever information you have committed to keep restricted: customer files, source code, pricing. Privacy is narrower in what it covers and wider in what it asks. It deals only with personal data, and with how you handle that data from collection to deletion. The AICPA separates the two categories on the same basis.

The two overlap where customer data includes personal data, which is most of the time for a SaaS firm. The deciding question is whose objectives the controls serve.

Many B2B software firms handle personal data on their customers' instructions. They do not decide why it is used. If that is you, we recommend checking whether Confidentiality and the common criteria answer the customer's question before you add the 18 Privacy criteria.

## Does the SOC 2 Privacy category prove UK GDPR compliance?

No. The Privacy category tests your controls against AICPA criteria over a period; it does not report on compliance with the UK GDPR. The AICPA says the criteria are generally not used when an auditor reports on compliance with laws and regulations. Accountability for UK GDPR compliance stays with the controller.

[Article 5(2) of the UK GDPR](https://www.legislation.gov.uk/eur/2016/679/article/5) makes the controller responsible for, and able to demonstrate, compliance with the data protection principles. A SOC 2 report can be part of that evidence, but the duty does not move to your auditor.

The AICPA publishes a mapping of the Trust Services Criteria to the GDPR. A mapping shows where the two overlap, not that one satisfies the other.

## Where do ISO 27001 Annex A controls already meet the SOC 2 common criteria?

If you hold ISO 27001, your Annex A controls already answer much of CC6 to CC9. Your management system clauses cover a good part of CC3 and CC4. Check CC1 and CC2 most carefully: oversight by your governing body, and how you communicate commitments to customers. ISO 27001 frames both differently from SOC 2.

The AICPA publishes its own mapping between the Trust Services Criteria and ISO 27001, which shows how much ground the two share. At concept level, the overlap looks like this:

- **CC1 and CC2.** ISO 27001's leadership, competence and communication clauses help. SOC 2 asks for more explicit evidence of oversight and of commitments made to customers.
- **CC3.** Your ISO 27001 risk assessment and treatment process, set out under [Clause 6.1](https://www.grcmana.io/vault/iso-27001/clause-6-1-actions-to-address-risks-and-opportunities), is the backbone. Make sure fraud risk is considered explicitly.
- **CC4 and CC5.** Internal audit, management review and the Statement of Applicability carry over well, as long as the evidence covers the whole report period.
- **CC6 to CC9.** The [Annex A controls](https://www.grcmana.io/vault/iso-27001/annex-a-controls) for access, operations, change, suppliers and continuity meet most of this ground directly.

What does not carry over is the form of the evidence. A SOC 2 auditor tests your controls against the criteria, sample by sample, over a defined period.

## What are the common mistakes with the SOC 2 Trust Services Criteria?

The common mistakes with the SOC 2 Trust Services Criteria are easy to name. Teams add categories to look thorough, treat points of focus as a checklist, adopt a generic controls list, and assume ISO 27001 or the Privacy category settles questions it does not. Each adds testing you did not need or leaves a gap a reviewer will find.

- **Scoping by reputation.** Adding all five categories reads as thorough but commits you to 61 criteria, most of which no customer asked about.
- **Treating points of focus as requirements.** This multiplies controls and evidence for no gain in assurance.
- **Adopting a downloaded controls list.** Controls written for someone else's system produce exceptions in yours.
- **Naming tools instead of outcomes.** A control that says which product you use breaks the day you change product.
- **Over-reading other assurance.** ISO 27001 certification does not cover CC1 and CC2 in SOC 2's terms, and the Privacy category is not a UK GDPR compliance opinion.

## Frequently asked questions

### How many SOC 2 Trust Services Criteria are there?

The 2017 Trust Services Criteria contain 61 criteria: 33 common criteria, plus 3 for Availability, 5 for Processing Integrity, 2 for Confidentiality and 18 for Privacy. A Security-only examination is assessed against the 33 common criteria. Points of focus are not counted, because they are guidance rather than criteria.

### Is Security mandatory in a SOC 2 report?

In effect, yes. You cannot commission a SOC 2 report on Availability or Confidentiality alone, because the common criteria sit inside every category. The real scoping question is never whether to include Security, only what to add to it.

### Are the SOC 2 trust principles the same as the Trust Services Criteria?

Yes, under an older name. Earlier editions of the AICPA framework were set out as Trust Services principles with related criteria. The current edition calls the five areas categories, so "trust principles" and "Trust Services Criteria" point to the same framework.

### Do I need to include all five Trust Services Criteria categories?

No. Security is the only category every report covers. Scope can grow later: when a new contract creates a commitment, we recommend adding the matching category at the next report period, with its controls running before that period starts.

### Did the 2022 update change the SOC 2 criteria?

The 2022 revision updated the points of focus. The AICPA's current edition still carries the 2017 Trust Services Criteria title. If your controls matrix was built against the 2017 criteria, check it against the revised points of focus rather than rebuilding it.