The scoping call happens early, before anyone has priced the engagement, and it sounds administrative. Which trust services criteria do you want to be examined against? Founders answer with ambition, because five sounds better than one, and then spend a year producing evidence for commitments they never made to a customer. The categories are not a badge collection. Each one you add is a set of numbered criteria that somebody has to satisfy every month of the observation period.
What Are the Trust Services Criteria?
They are the yardstick. A SOC 2 examination measures a service organization's controls against them, and without them there is nothing to hold an opinion about.
The criteria describe outcomes rather than controls, so a criterion says what has to be true and not which product to buy or how often to rotate a key. AICPA staff guidance covers this directly, and one FAQ topic is whether there is a minimum set of common controls that meet the trust services criteria. That the question needed answering tells you how often people expect a checklist and find criteria instead.
They are also the measure, not the deliverable. What a customer receives is an accountant's opinion rather than a certificate, bounded by the categories chosen, the system described and the period covered. A report examined against security alone is not weaker. It is narrower, and narrow is often right.
What Is the Difference Between a Category and a Criterion?
A category is one of the five headings. A criterion is a numbered statement inside it that your controls have to satisfy, and it is criteria, not categories, that an auditor tests.
The distinction matters because the categories are the same size in a sentence and wildly different in practice. NIST publishes a crosswalk between the NIST Privacy Framework and the 2017 Trust Services Criteria, mapped in both directions and referencing the October 2022 updates, and the workbook enumerates the criteria by identifier. Security runs CC1.1 through CC9.2 across nine series. Availability adds three, A1.1 to A1.3. Processing integrity adds five, PI1.1 to PI1.5. Confidentiality adds two, C1.1 and C1.2. Privacy adds eighteen, spread across eight series from P1.1 to P8.1.
Read those numbers again before the next scoping call. Confidentiality is two criteria. Privacy is eighteen, covering notice, consent, collection, retention, access, disclosure, quality and monitoring. That is not a larger version of the same job.
What Are the Five Trust Services Categories?
Each category answers a different question a customer might have, and each is worth including only if a customer is actually asking it.
| Category | The question it answers | Criteria | Include it when |
|---|---|---|---|
| Security | Is the system protected against unauthorized access, disclosure and damage? | CC1.1 to CC9.2 | Always. The common criteria are shared by all five categories |
| Availability | Is the system available for operation and use as committed? | A1.1 to A1.3 | You sell an uptime commitment, or customers cannot work while you are down |
| Processing integrity | Is processing complete, valid, accurate, timely and authorized? | PI1.1 to PI1.5 | You move money or transform data and the output has to be right |
| Confidentiality | Is information designated confidential protected as committed? | C1.1 to C1.2 | Contracts oblige you to protect information that is not personal data |
| Privacy | Is personal information collected, used, retained and disposed of as committed? | P1.1 to P8.1 | You answer for personal information as a controller and can be examined on it |
The security category carries a second name, the common criteria, because its criteria are shared across all five categories rather than belonging to security alone. That is the mechanical reason every examination includes them, and why people say security is mandatory. The other four are supplements: they add criteria on top of the common set and replace none of it.
Confidentiality and privacy are the pair most often confused, and the difference is the data rather than the strength of the protection. Confidentiality covers information somebody agreed to keep confidential: contract terms, source code, pricing, customer datasets. Privacy covers personal information belonging to identifiable people, and it brings obligations around notice, consent, access requests and retention that have nothing to do with how well the data is encrypted.
What Are the Common Criteria, CC1 Through CC9?
Nine series, and the split inside them explains why the first month of a SOC 2 engagement feels like a governance audit rather than a security one.
- CC1, control environment. Integrity and ethical values, board oversight, structure, competence, accountability. Five criteria, and the reason an auditor asks for your org chart before your firewall rules.
- CC2, communication and information. The information used to support internal control, and how it is communicated internally and externally.
- CC3, risk assessment. Objectives specified clearly enough to identify risk, risks analyzed, fraud considered, significant change assessed.
- CC4, monitoring activities. Evaluations that determine whether controls are present and functioning, and deficiencies communicated to whoever can fix them.
- CC5, control activities. Selecting and developing control activities, including over technology, and deploying them through policies and procedures.
- CC6, logical and physical access controls. Eight criteria, the largest series: authentication, provisioning and removal, physical access, encryption and the movement of data. In practice, multi-factor authentication everywhere, least privilege, leaver processes that run on the day, and encryption in transit and at rest.
- CC7, system operations. Configuration standards, monitoring for anomalies, evaluating security events, responding and recovering. Where vulnerability scanning on a schedule, centralized logging and a written incident response plan earn their keep.
- CC8, change management. One criterion, and among the most commonly failed. Changes to infrastructure, data, software and procedures are authorized, designed, tested and approved.
- CC9, risk mitigation. Business disruption risk, and risk arising from vendors and business partners.
The shape is deliberate. CC1 through CC5 follow the COSO internal control framework, a governance model rather than a security one, and they are where a technically excellent company most often finds gaps. Nobody fails CC6.1 for lack of interest in access control. Plenty of teams produce an exception at CC4 because the monitoring existed but nothing recorded that a human looked at it.
Which Trust Services Criteria Do You Need?
Your contracts already decided. The scoping call is where you find out what you promised.
Work backwards from commitments rather than forwards from capability. A service level agreement promising uptime puts availability on the table. A master services agreement defining confidential information puts confidentiality on the table. A product that calculates something a customer relies on, such as payroll, claims or billing, puts processing integrity on the table. Where none of that is written down, adding a category means committing to something new in order to be examined on it.
Scope also moves the invoice, because the number of categories is one of the main drivers of what the examination costs.
Are Points of Focus Part of the Criteria?
No, and the confusion is fair given that the document's own title advertises them.
A readiness partner or a compliance platform quoting a point of focus at you as a requirement has overstated the case. It may still be good advice. It is not a line the auditor tests, and treating it as one is how organizations end up running controls that satisfy a template rather than a criterion.
Do the Trust Services Criteria Prove Legal Compliance?
No, and the misreading runs in both directions. Companies think the report discharges a legal obligation, and buyers think it certifies that a vendor obeys the law.
The AICPA staff FAQ has a topic on exactly this question, whether a service auditor's opinion in a SOC 2 examination addresses the service organization's compliance with relevant laws and regulations. The Journal of Accountancy is blunter about the vocabulary: reporting on the market for SOC tooling in February 2026, it noted that vendors may promise compliance, a term never used in SOC 2 examinations, in weeks or even hours. The examination produces an opinion on controls against criteria, not a finding about statutes.
The reverse reading is just as common. A vendor holding a security-only SOC 2 has made no statement about how it handles personal data, and reading one in is how procurement teams get surprised. If personal information matters, ask which categories the report covers rather than whether a report exists. The same discipline applies to PCI DSS, a separate regime with its own assessors.
Can You Add Trust Services Criteria Later?
Yes, and growing the scope at a period boundary is normal. Categories are chosen for each examination, so a company can run security only in year one, add availability in year two, and add confidentiality when a contract starts defining it.
The mechanics matter before you agree to a date. A new category needs its controls operating for the whole observation period the auditor tests, not from the day you decided to add it, and nine months of evidence cannot be produced retroactively.
There is also a route that adds nothing to the five. The AICPA describes an engagement in which a service organization may engage the service auditor to examine and report on subject matters in addition to the description and the trust services criteria, evaluated against additional suitable criteria. That is how a report covers something specific to your industry without pretending it belongs to a category. Mappings work the same way: NIST's crosswalk lets a privacy program built to the Privacy Framework be assessed for SOC readiness, but a mapping buys reused evidence rather than equivalence, which is why ISO 27001 and SOC 2 stay two deliverables.
Key takeaways
- The trust services criteria are the AICPA's control criteria for SOC 2, published as the 2017 Trust Services Criteria with revised points of focus, 2022, and established by the Assurance Services Executive Committee.
- Five categories: security, availability, processing integrity, confidentiality and privacy. The security criteria are the common criteria, shared across all five, so every examination includes them.
- Categories are headings; criteria are the numbered statements auditors test. Security runs CC1.1 to CC9.2, availability A1.1 to A1.3, processing integrity PI1.1 to PI1.5, confidentiality C1.1 to C1.2, privacy P1.1 to P8.1.
- The size difference is the scoping decision. Confidentiality adds two criteria; privacy adds eighteen across eight series.
- CC1 through CC5 follow the COSO internal control framework, which is why governance gaps trip up technically strong companies more often than access control gaps do.
- Points of focus are considerations attached to criteria, not criteria themselves. There is nothing to fail.
- A SOC 2 opinion covers controls against criteria, not compliance with laws.
Common questions
What are the five trust services criteria?
Security, availability, processing integrity, confidentiality and privacy, from the AICPA's 2017 Trust Services Criteria. Strictly the five are categories, and the criteria are the numbered statements inside them.
Is security the only required trust services criterion?
Effectively yes, for a structural reason rather than a rule. The security criteria are the common criteria, shared by all five categories, so they appear in any examination whichever categories are selected. The other four supplement them and are chosen by the service organization.
What is the difference between a trust services category and a criterion?
A category is one of the five headings describing what the report covers. A criterion is a numbered statement inside it, such as CC6.1 or A1.2, that the controls have to satisfy. Auditors test criteria; buyers read categories.
What do CC1 through CC9 cover?
CC1 control environment, CC2 communication and information, CC3 risk assessment, CC4 monitoring activities, CC5 control activities, CC6 logical and physical access controls, CC7 system operations, CC8 change management, CC9 risk mitigation. CC6 is the largest series with eight criteria; CC8 has one.
Do I need the privacy category in my SOC 2 report?
Only if you handle personal information in your own right and a customer is asking about it. Privacy adds eighteen criteria across eight series, from notice and consent through retention and disposal, which is a far larger program than any other supplemental category.
Can I add trust services criteria to a later SOC 2 report?
Yes, and scopes commonly grow year over year. The constraint is timing: controls for a new category have to operate across the whole observation period the auditor tests, so a late decision lands the category in the following report.
What happens if a control fails inside a category I included?
The auditor describes it as an exception in the results section alongside management's response, and depending on severity the opinion can be qualified rather than unqualified. Exceptions are printed in the report your customers read.
Are points of focus mandatory?
No. Points of focus are characteristics that may be considered when evaluating whether a criterion is met, and the 2022 revision changed them without changing the criteria. A checklist presenting one as a pass or fail item has invented a requirement.
Do the trust services criteria overlap between categories?
Heavily, because the common criteria sit underneath all of them. One access review can serve criteria in CC6 and in confidentiality; one backup test can serve CC7 and A1.3. That overlap is why a second category costs far less than the first.
Does a SOC 2 report prove we comply with the law?
No. The examination gives an opinion on controls measured against the trust services criteria. Statutory obligations such as the HIPAA Security Rule and state breach notification laws run independently of any report you hold.
On this page
- What Are the Trust Services Criteria?
- What Is the Difference Between a Category and a Criterion?
- What Are the Five Trust Services Categories?
- What Are the Common Criteria, CC1 Through CC9?
- Which Trust Services Criteria Do You Need?
- Are Points of Focus Part of the Criteria?
- Do the Trust Services Criteria Prove Legal Compliance?
- Can You Add Trust Services Criteria Later?
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.