SOC 2 requirements: the complete list
Five Trust Services Categories. The Security category is mandatory. Here is everything your startup needs to implement to pass the audit.
The five Trust Services Categories
Security (CC) (Required)
The Common Criteria cover nine control domains: organizational governance, risk assessment, access controls, system operations, change management, and incident response. Every SOC 2 audit includes Security. No exceptions.
Availability (A) (Optional)
Uptime commitments, redundancy, disaster recovery, and business continuity. Include if customers have SLA requirements or if downtime creates material harm to users.
Processing Integrity (PI) (Optional)
Confirms your system processes data completely and accurately. Relevant for financial platforms, data pipelines, and ETL systems where incorrect processing causes harm.
Confidentiality (C) (Optional)
How you protect data designated as sensitive, including client data, trade secrets, and regulated commercial information. Relevant for companies holding sensitive data on behalf of customers.
Privacy (P) (Optional)
Collection, use, retention, and disposal of personal information. Include if you collect personal data from individuals and have GDPR or CCPA obligations.
Security (Common Criteria): key controls by category
CC1 to CC5: Foundation and risk management
CC1.1
Board and management demonstrate commitment to integrity and ethical values.
CC2.1
Management communicates information security policies to all personnel.
CC3.1
Management identifies risks to achieving organizational objectives.
CC4.1
Management monitors controls and evaluates whether they are operating effectively.
CC5.1
Management designs control activities to address identified risks.
CC6: Logical and physical access controls
CC6.1
Logical access to system components is restricted to authorized users via unique credentials and least-privilege access principles.
CC6.2
Authentication mechanisms include MFA for privileged accounts and remote access.
CC6.3
Access reviews are conducted periodically. Access is revoked promptly when no longer needed.
CC6.6
Encryption is used to protect data in transit and at rest where applicable.
CC6.7
Transmission of confidential information is protected via secure protocols.
CC7 to CC9: Operations, change management, and risk mitigation
CC7.1
Vulnerabilities are detected through continuous monitoring and timely patching processes.
CC7.2
Security incidents are identified, classified, and escalated using a defined incident response process.
CC8.1
Changes to infrastructure and applications go through an authorized change management process before deployment.
CC9.1
Vendor and third-party risk is assessed before onboarding and monitored on an ongoing basis.
CC9.2
Business continuity and disaster recovery plans are documented, tested, and maintained.
What you must implement for SOC 2 Security
Access control policy
Written policy covering how access is granted, reviewed, and revoked. Must be acknowledged by employees.
Multi-factor authentication
MFA required for remote access, cloud console access, and all privileged accounts.
Encryption at rest and in transit
Database encryption, TLS on all external connections, and key management documentation.
Vulnerability management
Regular dependency scanning, patch cadence, and penetration testing on a defined schedule.
Incident response plan
Documented process for detection, containment, analysis, and post-mortem. Tested at least annually.
Change management
Pull request reviews, staging environments, and deployment approvals. No direct pushes to production.
Vendor risk program
Documented list of critical vendors, their certifications, and your assessment of their risk.
Business continuity plan
Recovery time objectives, backup testing, and documented failover procedures.
Frequently asked
What are the SOC 2 requirements?
SOC 2 requirements are organized around five Trust Services Categories. Security is mandatory and covers nine control domains (CC1 to CC9). The other four categories are optional.
How many controls does SOC 2 require?
A typical startup SOC 2 Security-only audit covers 60 to 100 controls. The exact number depends on your system scope and the evidence your auditor requires.
What is the easiest SOC 2 requirement to fail?
Access control (CC6) is where most findings occur. Specifically: offboarding employees with retained access, no MFA on privileged accounts, and no documented access review process.
Do I need all five Trust Services Categories?
No. Security only is the standard starting point. Add categories based on your business model and customer requirements.
Related: SOC 2 compliance automation and SOC 2 timeline
Start your SOC 2