SOC 2 Trust Services Criteria: All 5 Principles Explained
Robin Joseph
Senior Security Consultant
SOC 2 trust services criteria are the five categories an auditor uses to judge how a company protects data: security, availability, processing integrity, confidentiality, and privacy.
Security is required in every SOC 2 report, and the other four are optional. The American Institute of Certified Public Accountants (AICPA) defines them, and together they contain 61 individual criteria. Older guides call them the SOC 2 trust principles. They mean the same thing.
Reviewed by Riya Ann Varghese, GRC Engineer, ISO 27001 lead auditor certified. Last updated October 19, 2026.
How We Wrote This Guide
We built this guide from the AICPA trust services criteria document itself, the 2017 Trust Services Criteria with revised points of focus (2022), and counted every criterion by hand. The example evidence comes from what auditors ask for during SOC 2 audits we support. A GRC engineer reviewed every section.
What Are the SOC 2 Trust Services Criteria?
The SOC 2 trust services criteria are the AICPA's official requirements that a SOC 2 auditor tests your controls against.
Every SOC 2 report states which categories it covers, and the auditor's opinion applies only to those. The criteria describe outcomes, such as "the entity restricts physical access to facilities", not specific tools. You choose the controls that meet them, which is why a 20-person startup and a large company can pass the same criteria with very different setups.
Are Trust Services Criteria the Same as SOC 2 Trust Principles?
Yes, trust services criteria is the current name for what the AICPA used to call the trust services principles.
The AICPA rewrote the framework in 2017 to line it up with the COSO 2013 internal control framework, and SOC 2 reports have used the 2017 criteria since December 2018. The five categories did not change.
Criteria vs Points of Focus
A criterion is the requirement your controls must meet, while a point of focus is an example of what a good control looks like.
For example, CC6.1 is the criterion on logical access security, and its points of focus mention things like restricting access to authorized users. Auditors use points of focus as a guide, but you do not have to meet every one.
What Are the 5 Trust Services Criteria?
The 5 trust services criteria are security, availability, processing integrity, confidentiality, and privacy.
| Criterion | Required? | What it covers | Criteria | Include it when |
|---|---|---|---|---|
| Security | Always | Protecting systems and data from unauthorized access, disclosure, and damage | 33 | Every SOC 2 report |
| Availability | Optional | Systems staying up and usable as promised | 3 | You promise uptime in contracts or SLAs |
| Processing Integrity | Optional | Complete, accurate, timely, authorized processing | 5 | Customers rely on your transactions or calculations |
| Confidentiality | Optional | Business information you promised to keep secret | 2 | Customers share sensitive business data under NDA |
| Privacy | Optional | How personal information is collected, used, kept, shared, and deleted | 18 | You collect personal data directly from people |
How Many SOC 2 Criteria Are There?
SOC 2 has 61 criteria in total, and 33 of them are the common criteria under Security.
The rest of the SOC 2 criteria list, 28 criteria, belongs to the four optional categories: 3 for availability, 5 for processing integrity, 2 for confidentiality, and 18 for privacy. If you scope in Security only, your auditor tests 33 criteria. Add Availability and Confidentiality, and it becomes 38. Each category you add brings its own evidence and audit hours, so scope has a direct effect on SOC 2 audit cost.
Security: The Only Required Criterion
Security is the one trust services criterion every SOC 2 report must include, and it covers protecting systems and data from unauthorized access, disclosure, and damage.
Written policies are not enough. Auditors check that your controls actually work, and for a SOC 2 Type 2 report, that they worked across the whole audit period.
What Are the SOC 2 Common Criteria?
The SOC 2 common criteria are the 33 Security criteria, grouped CC1 to CC9, that every SOC 2 report is tested against.
They are called common because the other four categories rely on the same base of governance, risk assessment, monitoring, and access control. This is the evidence auditors usually ask for in each group:
| Group | Name | Criteria | Example evidence auditors ask for |
|---|---|---|---|
| CC1 | Control environment | 5 | Signed code of conduct, org chart, background checks |
| CC2 | Communication and information | 3 | Published security policies, a way to report incidents |
| CC3 | Risk assessment | 4 | A yearly risk assessment and risk register |
| CC4 | Monitoring activities | 2 | Internal control reviews, vulnerability scan results |
| CC5 | Control activities | 3 | Approved policies, separation of duties |
| CC6 | Logical and physical access | 8 | MFA settings, quarterly access reviews, offboarding records, encryption settings |
| CC7 | System operations | 5 | Monitoring alerts, incident tickets, recovery tests |
| CC8 | Change management | 1 | Approved pull requests and change tickets |
| CC9 | Risk mitigation | 2 | Vendor reviews, a business continuity plan |
Missing evidence for any of these shows up as a finding in the report. Our guide to SOC 2 exceptions explains what that means and how to respond, and our SOC 2 compliance checklist turns this table into steps.
Availability (A1.1 to A1.3)
Availability is the trust services criterion that checks whether your systems stay up and usable as promised to customers.
| Criterion | Covers | What it means |
|---|---|---|
| A1.1 | Capacity | You monitor usage and add capacity before you hit limits. |
| A1.2 | Backups and recovery | You protect against outages and keep reliable backups and failover. |
| A1.3 | Recovery testing | You test restoring from backup at least once a year and keep the results. |
When to include it: your contracts or SLAs promise uptime, or an outage would stop your customers' work.
Processing Integrity (PI1.1 to PI1.5)
Processing integrity is the trust services criterion that checks whether your system processes data completely, accurately, on time, and only when authorized.
It proves your system handles data correctly once it arrives. It does not prove the data customers type in is correct.
| Criterion | Covers | Example evidence |
|---|---|---|
| PI1.1 | Processing definitions and specifications | Documented data definitions |
| PI1.2 | System inputs | Input validation rules |
| PI1.3 | System processing | Reconciliations and batch totals |
| PI1.4 | Outputs | Output checks and delivery logs |
| PI1.5 | Storage | Integrity checks and retention rules |
When to include it: you process payments, payroll, orders, or calculations that customers rely on being exact.
Confidentiality (C1.1 to C1.2)
Confidentiality is the trust services criterion that protects business information you have promised to keep secret, such as contracts, trade secrets, and client data under NDA.
| Criterion | Covers | What it means |
|---|---|---|
| C1.1 | Identify and protect | You use a classification policy, role-based access, and encryption for confidential data. |
| C1.2 | Dispose | You follow retention rules, delete data securely, and keep records of what was destroyed. |
Confidentiality covers business information, while privacy covers personal information about individuals.
When to include it: customers share sensitive business data with you, which is true for most B2B software companies.
Privacy (P1.1 to P8.1)
Privacy is the trust services criterion that checks how you collect, use, keep, share, and delete personal information.
It is the largest category, with 18 criteria in eight groups. A SOC 2 privacy report does not replace compliance with laws like GDPR or HIPAA, which have their own rules.
| Group | Criteria | What it means |
|---|---|---|
| P1 Notice | P1.1 | You tell people what personal data you collect and why. |
| P2 Choice and consent | P2.1 | You give people choices about their data and get consent where needed. |
| P3 Collection | P3.1 to P3.2 | You collect only the personal data you need for the purpose you stated. |
| P4 Use, retention, and disposal | P4.1 to P4.3 | You use data only as stated, keep it only as long as needed, then dispose of it securely. |
| P5 Access | P5.1 to P5.2 | People can see and correct the personal data you hold about them. |
| P6 Disclosure and notification | P6.1 to P6.7 | You share data with third parties only as stated and tell people about breaches. |
| P7 Quality | P7.1 | You keep personal data accurate, complete, and up to date. |
| P8 Monitoring and enforcement | P8.1 | You handle privacy complaints and check that you keep your privacy promises. |
When to include it: you collect personal information directly from people and make privacy promises to them.
Which Trust Services Criteria Should You Include?
Include Security, then add only the criteria that match promises you make to customers in contracts, SLAs, or your security documentation.
Most companies start their first year with Security alone, or Security plus Availability, and add more when customers ask. This is the scope we usually see by business type:
| Business type | Common SOC 2 scope |
|---|---|
| B2B SaaS | Security, Availability, Confidentiality |
| Payments and fintech | Security, Availability, Processing Integrity |
| Payroll and HR software | Security, Processing Integrity, Privacy |
| Health tech | Security, Confidentiality, Privacy |
| Data and analytics platforms | Security, Availability, Confidentiality |
What If a Customer Asks for All Five?
If a customer asks for all five criteria, ask what risk they want covered before you expand your scope.
The request often comes from a generic questionnaire, and Security plus Confidentiality may answer the real concern. Extra criteria raise cost every year and can create findings in areas that do not matter to your business.
How UprootSecurity Helps You Meet the Trust Services Criteria
UprootSecurity maps your controls to every criterion in your scope and collects the evidence automatically.
- Right scope from day one: a dedicated compliance expert helps you pick only the criteria your customers need.
- Controls mapped to each criterion: ready-made policies and controls mapped to CC1 to CC9 and the optional categories.
- Evidence that stays current: continuous monitoring across 140+ integrations, so the evidence in the table above is collected for you.
→ See how it works: book a demo
What Happens When You Change Your Scope?
A new trust services criterion needs its own observation period, so it cannot cover months that have already passed.
A SOC 2 Type 1 report checks that controls are designed correctly on a single date. A Type 2 report tests whether they worked over a period, usually 3 to 12 months. Decide your full scope before the observation period starts. If a customer later asks for a new criterion, a Type 1 report on it can bridge the gap until your next Type 2.
What Changed in the 2022 Update?
The 2022 update did not change the AICPA trust services criteria themselves; it revised the points of focus that explain how to meet them.
According to EY's summary, the main changes added detail on risk assessment, access for every account type, patch management, ransomware-resistant backups, and privacy duties for data controllers versus processors. In practice, auditors now expect patch records, protected backups, and access reviews that include service accounts.
Which SOC Reports Use the Trust Services Criteria?
SOC 2 and SOC 3 reports use the trust services criteria, but SOC 1 does not, because it covers controls over customers' financial reporting.
- SOC 2: a detailed report with the auditor's tests, shared under NDA.
- SOC 3: a short public summary using the same criteria, often posted in a trust center.
- SOC 1: controls over financial reporting. See SOC 1 vs SOC 2.
How Do the Criteria Map to COSO, ISO 27001, and NIST?
The first 17 common criteria, CC1.1 to CC5.3, are the 17 principles of the COSO 2013 framework. The rest overlap with many ISO 27001 Annex A controls, and the AICPA publishes official mappings to ISO 27001 and the NIST Cybersecurity Framework. One set of well-documented controls can serve several audits.
How UprootSecurity Approaches Compliance
Choosing the right trust services criteria is the first decision. Proving you meet them across the whole audit period is the work that follows.
| What your SOC 2 needs | How UprootSecurity handles it |
|---|---|
| The right scope | A dedicated compliance expert helps you pick the criteria your customers actually need |
| Controls mapped to each criterion | Ready-made controls and policies mapped to the trust services criteria, and to 22 frameworks in total |
| Evidence across the audit period | Continuous monitoring across 140+ integrations |
| Proof for customers | A trust center and security questionnaire automation |
| Real security testing | A yearly penetration test in every plan |
| A clear price | A custom quote based on your scope, plus a 14-day free trial |
UprootSecurity is a compliance platform for startups and scaleups that need SOC 2, ISO 27001, HIPAA, or other frameworks. We collect evidence from your cloud, code, identity, and HR tools, and a dedicated compliance expert guides your team through readiness and the audit. See our SOC 2 framework page and plans.
Frequently Asked Questions
The five trust services criteria for SOC 2 are security, availability, processing integrity, confidentiality, and privacy. The AICPA defines them, and auditors use them to judge how a company protects systems and data. Security is required in every SOC 2 report, while the other four are optional and added based on what you promise customers.
Security is the only trust services criterion required for every SOC 2 report. Its 33 common criteria cover governance, risk assessment, monitoring, access control, system operations, change management, and vendor risk. Availability, processing integrity, confidentiality, and privacy are optional, and you include them only when they match commitments you make to customers.
The common criteria for SOC 2 are the 33 Security criteria, grouped CC1 to CC9. They cover control environment, communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management, and risk mitigation. They are called common because every other category relies on them.
SOC 2 has 61 criteria in total across the five categories. Security has 33 common criteria, availability has 3, processing integrity has 5, confidentiality has 2, and privacy has 18. A report covering only Security is tested against 33 criteria, and each optional category you add brings its own criteria into the audit.
Yes, trust principles is the old name for the same framework. The AICPA renamed the Trust Services Principles and Criteria to the Trust Services Criteria in 2017, aligning them with the COSO 2013 framework. The five categories stayed the same, and SOC 2 reports have used the 2017 criteria since December 2018.
To be SOC 2 compliant, a company needs controls that meet the trust services criteria in its scope, evidence that those controls work, and a clean report from an independent CPA firm. That means written policies, access controls, monitoring, risk assessments, and vendor reviews at a minimum. Our SOC 2 compliance checklist walks through each step.
No, most companies should not include all five trust services criteria. Include Security, then add only the categories that match promises in your contracts, SLAs, or privacy notices. Every added category increases audit cost, evidence work, and the chance of findings, so many companies start with Security and expand later.
The difference between SOC 2 and SOC 3 is the level of detail and who can see the report. Both use the same trust services criteria. A SOC 2 report includes the auditor's detailed tests and is shared under NDA, while a SOC 3 report is a short public summary that companies often post on their website.
No, a SOC 2 report does not mean you are HIPAA compliant. HIPAA is a US law with its own rules for protected health information, while SOC 2 is an attestation against the AICPA's criteria. Many controls overlap, so some auditors offer a combined SOC 2 plus HIPAA report, but you still need to meet HIPAA's own requirements.
Getting SOC 2 compliance is manageable for most companies, but it takes steady work over several months. The effort depends on how many trust services criteria you include and how many gaps you start with. A Type 2 report also needs an observation period of 3 to 12 months, so plan the timeline before customers ask.
SOC 2
