The SOC 2 Trust Services Criteria, explained one by one
Each criterion on one page: what it asks, what proves it, and whether it is in your scope.
The Trust Services Criteria are the yardstick a SOC 2 examination measures you against. There are 61. 33 are the common criteria, which every report covers. The other 28 sit in four optional categories you add only when customers need them.1
Each criterion below has its own page: what it asks a startup to show, the records that usually prove it, the questions the readiness assessment asks about it, and the policies, templates and connected systems that cover it.
How to read these pages
A criterion is not a control. It states an outcome. You choose the controls that meet it, and the auditor tests those controls against what your own policies say, which is why two companies can pass the same criterion with different tools. These pages describe each outcome in plain words and the evidence that usually shows it. They never reprint the standard's own text. For the count and how it breaks down, read how many criteria SOC 2 has.
Security: the common criteria
The common criteria. Every SOC 2 report covers them, whatever else you add: governance, risk, access, operations, change and vendors. Most of the work in any SOC 2 sits here. There are 33 common criteria in 9 groups, CC1.1 to CC9.2, and every one is in scope for every company.
CC1: Control environment
- CC1.1, integrity and ethics: Leadership writes down how people at the company are expected to behave, and everyone agrees to it in writing.
- CC1.2, board oversight: Someone outside day to day management looks at security on a schedule.
- CC1.3, structure and reporting: The company has a clear shape: who reports to whom, who owns security, and who can approve what.
- CC1.4, hiring and competence: You hire people who can do the work and you keep them trained.
- CC1.5, accountability: People are held to the security duties they signed up for.
CC2: Communication and information
- CC2.1, reliable information: The information your controls run on is complete and accurate.
- CC2.2, internal communication: Everyone inside the company knows the security rules and their own part in them.
- CC2.3, external communication: Customers and partners know what you commit to and how to reach you about security.
CC3: Risk assessment
- CC3.1, risk objectives: Before you can assess risk you have to say what you are protecting and why.
- CC3.2, risk identification: You look for what could go wrong, at least once a year, and decide what to do about each risk.
- CC3.3, fraud risk: The risk assessment considers people doing the wrong thing on purpose, not only accidents.
- CC3.4, changes that add risk: When something significant changes, you check whether your risks changed with it.
CC4: Monitoring
- CC4.1, control monitoring: You check that your controls keep working, rather than assuming they do.
- CC4.2, fixing deficiencies: When a check finds a problem, the right people hear about it and someone fixes it.
CC5: Control activities
- CC5.1, choosing controls: Every risk you decided to reduce has a control pointed at it.
- CC5.2, technology controls: The controls built into your technology are chosen on purpose.
- CC5.3, policies and procedures: Your controls are written into policies, and the policies are followed.
CC6: Logical and physical access
- CC6.1, logical access: Only the right people and systems can get into your environment.
- CC6.2, user provisioning: New accounts are approved before they are created, and accounts are removed when people leave.
- CC6.3, least privilege: People get the access their role needs and no more, and that access is reviewed.
- CC6.4, physical access: Only authorized people can get into the places where your systems live.
- CC6.5, data and device disposal: When you retire a laptop, a drive or a data store, the data on it is destroyed first.
- CC6.6, network boundaries: You control what can reach your systems from outside.
- CC6.7, data in transit: Data moving between systems, or out of the company, is protected and goes only where it should.
- CC6.8, malware prevention: You stop unauthorized or malicious software from getting into your systems, and you notice when it does.
CC7: System operations
- CC7.1, vulnerability monitoring: You find weaknesses in your systems before someone else does.
- CC7.2, anomaly monitoring: You watch your systems for signs of attack, failure or error.
- CC7.3, incident triage: When something odd happens, you decide whether it is a security incident.
- CC7.4, incident response: Once something is an incident, you run the plan: contain it, fix it and tell the people who need to know.
- CC7.5, incident recovery: After an incident you restore what broke and learn from it.
CC8: Change management
- CC8.1, change management: Changes to code and infrastructure are reviewed, tested and approved before they reach production.
CC9: Risk mitigation
- CC9.1, disruption risk: You plan for business disruption, from an outage to losing a key vendor.
- CC9.2, vendor risk: You know which vendors touch your data and you check them.
Availability: optional
Whether the service stays up as promised. Capacity, backups, redundancy and tested recovery. It belongs in scope when customers rely on an uptime commitment in your contracts. 3 criteria, in the report only when you add Availability to the scope.
The scoping tool decides it with one question: Add it when your contracts promise uptime, such as a 99.9 percent service level, or customers cannot run their own business while you are down.
- A1.1, capacity planning: You watch how much of your system capacity is in use and add more before you run out.
- A1.2, recovery infrastructure: The environment can survive a failure.
- A1.3, recovery testing: You prove the recovery plan works by testing it.
Processing Integrity: optional
Whether the system processes data completely, accurately and on time. Inputs, processing, outputs and stored records. It fits a product whose customers depend on its calculations or transactions being right. 5 criteria, in the report only when you add Processing Integrity to the scope.
The scoping tool decides it with one question: Add it when customers rely on your processing being complete and accurate, such as payments, payroll, invoices or calculations they act on.
- PI1.1, processing specifications: You define what your system is supposed to process and how.
- PI1.2, input controls: Data coming into the system is checked before it is used.
- PI1.3, processing controls: Processing happens completely, accurately and on time.
- PI1.4, output controls: What the system produces is complete and accurate, and it goes only to the people meant to receive it.
- PI1.5, stored data integrity: Data you store, at every stage, stays complete and accurate.
Confidentiality: optional
How you identify and protect information you have agreed to keep confidential, and how you destroy it when the time comes. It fits a company whose contracts carry confidentiality obligations. 2 criteria, in the report only when you add Confidentiality to the scope.
The scoping tool decides it with one question: Add it when contracts or non-disclosure agreements commit you to keep customer or partner information confidential.
- C1.1, confidential data handling: You know which information is confidential and you protect it to match.
- C1.2, confidential data disposal: Confidential information is destroyed when you no longer need it or when a contract says so.
Privacy: optional
How you handle personal information across its life: notice, consent, collection, use, retention, access requests, disclosure and complaints. It is the heaviest category and assumes a privacy program already runs. 18 criteria, in the report only when you add Privacy to the scope.
The scoping tool decides it with one question: Add it when you collect personal information about individuals and run a privacy program with a notice, consent and requests from the people it describes. When personal information is incidental to your service, Confidentiality is often the closer fit.
P1: Privacy notice
- P1.1, privacy notice: People whose personal information you hold are told what you collect, why and what you do with it.
P2: Choice and consent
- P2.1, choice and consent: People are told what choices they have about their personal information, and their choices are recorded and honored.
P3: Collection
- P3.1, collection limits: You collect only the personal information you need for the purposes you stated.
- P3.2, explicit consent: Where the law or your own notice requires explicit consent, you ask for it clearly and keep the record.
P4: Use, retention and disposal
- P4.1, use limits: You use personal information for the purposes you told people about and nothing else.
- P4.2, personal data retention: You keep personal information only as long as you need it.
- P4.3, personal data disposal: When personal information reaches the end of its retention period, it is disposed of securely.
P5: Access by the people concerned
- P5.1, access requests: People can ask to see the personal information you hold about them, and you answer.
- P5.2, correction requests: People can ask you to correct their personal information, and you either fix it or explain why not.
P6: Disclosure and notification
- P6.1, third party disclosures: You share personal information with other parties only for the purposes you disclosed and with the consent you need.
- P6.2, disclosure records: You keep a record of the personal information you share and with whom.
- P6.3, unauthorized disclosures: When personal information is shared without authorization, whether by mistake or in a breach, you record it.
- P6.4, processor commitments: Vendors that handle personal information for you commit in writing to protect it the way you promised.
- P6.5, processor breach notice: Vendors that hold personal information for you agree to tell you quickly if it is exposed.
- P6.6, breach notification: When a breach affects personal information, you tell the people affected and the regulators the law requires, on time.
- P6.7, disclosure reports: When someone asks what personal information you hold about them and who you shared it with, you can tell them.
P7: Quality
- P7.1, data quality: The personal information you keep is accurate, complete and relevant for its purpose.
P8: Monitoring and complaints
- P8.1, complaints and monitoring: People can raise a privacy question or complaint, and you answer it.
Choosing what is in scope
Security is the default and always in scope. Availability, Processing Integrity, Confidentiality and Privacy can be added in the assessment, and each one you add is then part of the examination. Add a category because a customer contract asks for it, not to make the report look bigger: every extra criterion is one more thing the auditor tests. The scoping tool asks the four questions above and recommends a set, and the evidence checklist shows what each area asks you to collect.
Questions
What are the SOC 2 Trust Services Criteria?
How many Trust Services Criteria are there?
Which Trust Services Criteria are required?
Is a Trust Services Criterion the same as a control?
Sources
Get audit-ready without a compliance team.
The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.
Take the free assessmentPolara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.