Trust Services Criteria
The Trust Services Criteria (TSC) are the five categories used in SOC 2 to evaluate whether a service organization protects customer data. The criteria are maintained by the American Institute of Certified Public Accountants (AICPA). They define what an auditor tests when they assess your compliance posture.
Every SOC 2 report must include the Security category. The other four are optional, depending on what your customers need.
The Five Trust Services Categories
CC: Security (Common Criteria)
Security is the required category for every SOC 2 audit. The Common Criteria cover nine control domains:
- CC1 (Control Environment) - Organizational governance and accountability
- CC2 (Communication and Information) - Internal policies and external disclosures
- CC3 (Risk Assessment) - How you identify and respond to threats
- CC4 (Monitoring Activities) - Ongoing oversight of controls
- CC5 (Control Activities) - Policies and procedures to mitigate risks
- CC6 (Logical and Physical Access Controls) - Who can access what systems
- CC7 (System Operations) - Change management and incident response
- CC8 (Change Management) - How you deploy software and infrastructure changes
- CC9 (Risk Mitigation) - Vendor management and business continuity
CC6 and CC7 are where most findings occur. Access control (CC6.1 to CC6.7) covers authentication, authorization, and offboarding. System operations (CC7.1 to CC7.5) covers detection, incident response, and recovery.
A: Availability
The Availability category applies if your customers rely on your service being up. It covers uptime commitments, redundancy, disaster recovery, and business continuity planning. SaaS companies with SLA commitments typically include Availability.
PI: Processing Integrity
Processing Integrity confirms your system processes data completely, accurately, and in the right sequence. It applies to financial processing platforms, data pipelines, and ETL systems where incorrect processing would cause harm.
C: Confidentiality
Confidentiality covers how you protect data that is designated as sensitive, including client data, trade secrets, and regulated information. Companies that hold sensitive commercial data often include this category.
P: Privacy
Privacy covers the collection, use, retention, and disposal of personal information. It aligns closely with GDPR and CCPA obligations. SaaS companies that collect personal data from end users often include Privacy.
Which Categories Do You Need?
Most startups begin with Security only. That covers the Common Criteria and satisfies the baseline requirement for enterprise security reviews.
Add Availability if customers have uptime SLAs in their contracts. Add Confidentiality if you process sensitive commercial data. Add Privacy if you collect personal information from individuals. Add Processing Integrity if you are a financial or data processing platform.
Key Control Examples
| Control ID | Category | What It Tests |
|---|---|---|
| CC1.1 | Security | Board and management oversight of internal controls |
| CC6.1 | Security | Logical access restricted to authorized users |
| CC6.2 | Security | Authentication mechanisms (MFA, SSO) |
| CC6.3 | Security | Access reviews and revocation |
| CC7.1 | Security | Anomaly and vulnerability detection |
| CC7.2 | Security | Incident identification and classification |
| CC8.1 | Security | Change management authorization process |
| A1.1 | Availability | Infrastructure capacity and performance monitoring |
| C1.1 | Confidentiality | Identification of confidential information |
Related: SOC 2 compliance automation and SOC 2 requirements.
Frequently Asked Questions
Do I need all five Trust Services Categories? No. Security is mandatory. The others are optional and depend on your business model and what your customers require.
Who maintains the Trust Services Criteria? The AICPA publishes and updates the TSC. The current version is the 2017 TSC, updated for clarity in subsequent years.
How often do the criteria change? The AICPA issues occasional updates. When it does, whoever owns your program should re-map your controls to the current criteria before the next audit period starts.
What is the difference between criteria and controls? The criteria are the requirements (set by the AICPA). Controls are the specific things your organization does to meet those requirements. One criterion can require multiple controls.