Trust Services Criteria (TSC)
The Trust Services Criteria are the AICPA control framework that SOC 2 reports are evaluated against — organized into five categories: Security (the mandatory Common Criteria), Availability, Processing Integrity, Confidentiality, and Privacy.
The five categories
Security is the only mandatory category — every SOC 2 report covers the Common Criteria (CC1–CC9): control environment, communication, risk assessment, monitoring, control activities, logical access, system operations, change management, and risk mitigation. The other four categories are optional and added when your service commitments require them: Availability for uptime promises, Processing Integrity for accurate and complete processing, Confidentiality for protecting sensitive data, and Privacy for personal-information handling.
In total the framework defines 52 criteria. A SaaS company with an SLA typically reports on Security plus Availability; a company handling regulated personal data adds Privacy and Confidentiality.
How auditors use them
Each criterion has points of focus — illustrative characteristics the auditor considers when judging whether your controls meet the criterion. You map your controls to the criteria you committed to; the auditor tests design (Type I) and operating effectiveness (Type II) against them.
Related Standards
- •AICPA Trust Services Criteria (2017, revised 2022)
Free Tools & Resources
Further Reading
Need help with this?
We consult and build across all of these domains — tell us what you are working on.