Tools · 3 min read

Which Trust Services Criteria should I include?

Security is mandatory. The other four categories are a choice, and most first reports should not make it.

Which Trust Services Criteria should I include? For a first report, usually one. Security. It is mandatory in every SOC 2,¹ and it covers what buyers are actually worried about. The other four are optional, and you add one because a signed contract already commits you to it.

Answer the four questions below as your contracts read today, not as your roadmap reads. The tool names the categories that follow, and why.

Scope is the first real decision in a SOC 2. It sets how many controls you design, how much evidence you produce every month, and how long the examination runs. A wider scope is not a stronger report. It is a longer one.

Does a signed customer contract commit you to uptime, an SLA credit, or a recovery time?

Does a contract designate data you hold as confidential, with a duty to return or destroy it?

Do you process transactions or records on a customer’s behalf, where a wrong output is their problem?

Do you handle personal information under your own privacy notice, rather than only as your customer’s processor?

1of five categories in scope

0added because a contract says so

Security: Mandatory. Every SOC 2 report includes it, so this is never a choice. It covers access control, change management, monitoring, and incident response, and it is what buyers mean when they say SOC 2.

That is the whole answer for most first reports: Security, and nothing else. Every Polara GRC assessment starts there.

What each optional category commits you to

The only real choice is which of the other four you take on. Each one is a promise. Add it and an auditor tests whether you kept it.

Category	The promise you are making
Availability	Your service will be there, and you can bring it back when it is not
Confidentiality	Designated data stays restricted for exactly as long as the contract says
Processing Integrity	Records leave your system right, on time, and only when someone authorized them
Privacy	Personal information is handled the way your published notice says it is

Turn one on above and the tool names the work that comes with it. None of it is exotic. There is just more of it, produced every month for someone else to test, and that is what a longer engagement is.

Why scope moves the work

An examination is built on work, and scope is the work, so two companies the same size, one scoped to Security and one scoped to all five categories, are not asking an auditor to test the same thing and should not expect the same engagement. What SOC 2 actually costs takes the invoice apart line by line. If you want the calendar instead, how long SOC 2 takes covers the observation window and the external items that set your floor.

What a buyer asks for also depends on what you sell. The scoping question comes up differently in SOC 2 for API and developer tool companies, SOC 2 for agencies, SOC 2 for legal tech and SOC 2 for fintech.

The mistake that slows a first SOC 2

Adding categories nobody asked for reads as thorough. It makes a first SOC 2 slower and heavier, and the buyer who triggered it did not ask for it.

Ask the buyer. Their security questionnaire or the contract itself will name what they need, and in most business software deals that name is Security. If they do want Availability, the commitment is usually already sitting in the agreement you signed. Scope to what is written down. Revisit it next year if a real customer makes you. The category definitions, criterion by criterion, are in the Trust Services Criteria guide.¹

Scope is not permanent

A later report can be wider than your first, with a customer behind it. In Polara GRC you can add a category from your account settings until the engagement letter is signed or the audit is requested. Adding a category nobody needed is waste either way.

Who signs off on the scope

Through Polara GRC you choose the scope in the assessment and the engagement letter names it. With any other firm, scope is agreed in the engagement letter too. Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Questions

Which Trust Services Criteria are required?

Only Security. It is the common criteria set that every SOC 2 report contains. Availability, Confidentiality, Processing Integrity and Privacy are optional, and you add one because a contract or a buyer requires it.

Do I need Availability or Confidentiality for my first SOC 2?

Usually not. Add Availability if a signed contract commits you to uptime or a recovery time. Add Confidentiality if a contract designates data you hold as confidential and puts return or destruction duties on you. Otherwise Security alone answers what most buyers ask for.

Does adding a category make the report stronger?

It makes it wider, not stronger. Every category adds controls to design, evidence to produce each month and hours for the auditor to test. A category nobody asked for is work with no buyer behind it.

Can I add a category to my next report?

Scope is set for each examination, so a later report can be wider than the first. In Polara GRC you choose the categories in the assessment, and each one you add goes into your report, your engagement letter and the auditor’s examination.

Who decides the final scope?

You and the firm agree it in the engagement letter. In Polara GRC you choose it in the assessment, and the engagement letter names exactly what you chose. Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Sources

TSP Section 100, Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy AICPA. The criteria themselves, including the common criteria every SOC 2 report covers.

Get audit-ready without a compliance team.

The readiness assessment is free, with no payment and no card. Star is $2,000 one time to get on the platform and close your gaps. Orbit is $7,800 a year, and your SOC 2 Type 2 audit is included in every contract year. You can be audit-ready starting at about a week.

Take the free assessment

Polara Labs is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.