The Trust Services Criteria (TSC) — published by the AICPA in TSP section 100 — are the benchmark every SOC 2 examination is performed against. The 2017 revision (with updated points of focus in 2022) defines 33 Common Criteria in the CC1–CC9 series plus 19 additional criteria across four optional categories — Availability (A1), Processing Integrity (PI1), Confidentiality (C1), and Privacy (P series). Every SOC 2 report must cover Security — the Common Criteria — and adds optional categories only when the service commitments or system requirements warrant them.
Where does this list fit? Unlike ISO 27001's Annex A control catalogue, the TSC are criteria — desired outcomes — not prescriptive controls. You design the controls; the auditor evaluates whether they meet the criteria. If you're deciding between frameworks, see our SOC 2 vs ISO 27001 comparison. To score where you stand right now, run the free SOC 2 Readiness Checker — it walks all five categories as a questionnaire and produces a PDF gap report.
How the Criteria Are Organized
The nine Common Criteria series (CC1–CC9) are built on the COSO internal control framework — control environment, communication, risk assessment, monitoring, and control activities — extended with security-specific series for logical/physical access (CC6), system operations (CC7), change management (CC8), and risk mitigation (CC9). Each criterion in the standard also carries points of focus: implementation guidance describing the characteristics auditors expect. Points of focus are not checkboxes — an auditor evaluates whether your controls meet the criterion, not whether you did each point literally.
- Common Criteria (CC1–CC9) — 33 criteria · always required
- Availability (A1) — 3 criteria · add if you make uptime commitments
- Processing Integrity (PI1) — 5 criteria · add if you process transactions
- Confidentiality (C1) — 2 criteria · add for sensitive business data
- Privacy (P series) — 9 criteria · add when handling personal information
The Complete Criteria List
CC1 — Common Criteria: Control Environment · 5 criteria
| Ref | Criterion | What it covers |
|---|
| CC1.1 | Integrity and ethical values | Leadership demonstrates commitment to integrity and ethical values — tone at the top that anchors every other control. |
| CC1.2 | Board independence and oversight | The board (or equivalent) exercises independent oversight of internal control development and performance. |
| CC1.3 | Structures and responsibilities | Management establishes structures, reporting lines, authorities, and responsibilities aligned to objectives. |
| CC1.4 | Commitment to competence | Hiring, onboarding, training, and evaluation practices ensure people are competent for their security-relevant roles. |
| CC1.5 | Accountability | Personnel are held accountable for internal control responsibilities through performance measures and enforcement. |
CC2 — Common Criteria: Communication and Information · 3 criteria
| Ref | Criterion | What it covers |
|---|
| CC2.1 | Relevant quality information | The entity obtains or generates relevant, quality information to support internal control functioning. |
| CC2.2 | Internal communication | Objectives, responsibilities, and control information are communicated internally so personnel can perform their roles. |
| CC2.3 | External communication | Relevant matters — commitments, incidents, requirements — are communicated to external parties including customers and vendors. |
CC3 — Common Criteria: Risk Assessment · 4 criteria
| Ref | Criterion | What it covers |
|---|
| CC3.1 | Objectives and risk identification | Objectives are specified clearly enough to identify and assess risks relating to them. |
| CC3.2 | Risk analysis and response | Risks are analyzed for likelihood and impact, and a basis for risk response is determined. |
| CC3.3 | Fraud risk | The potential for fraud — including insider misuse and reporting manipulation — is assessed explicitly. |
| CC3.4 | Significant change | Risks arising from significant changes (new products, infrastructure, acquisitions, reorganizations) are identified and assessed. |
CC4 — Common Criteria: Monitoring Activities · 2 criteria
| Ref | Criterion | What it covers |
|---|
| CC4.1 | Ongoing and separate evaluations | Controls are evaluated through ongoing monitoring, periodic self-assessments, or internal audits to confirm they keep working. |
| CC4.2 | Deficiency communication | Control deficiencies are evaluated and communicated to the parties responsible for corrective action — including management and the board. |
CC5 — Common Criteria: Control Activities · 3 criteria
| Ref | Criterion | What it covers |
|---|
| CC5.1 | Control selection and deployment | Control activities are selected and deployed to mitigate risks to acceptable levels. |
| CC5.2 | Technology general controls | General controls over technology — infrastructure, security management, acquisition/development/maintenance — support the achievement of objectives. |
| CC5.3 | Policies and procedures | Control activities are deployed through policies that establish expectations and procedures that put them into action. |
CC6 — Common Criteria: Logical and Physical Access · 8 criteria
| Ref | Criterion | What it covers |
|---|
| CC6.1 | Logical access infrastructure | Logical access security software, infrastructure, and architectures protect information assets from unauthorized access. |
| CC6.2 | User registration and authorization | New users are registered and authorized before credentials are issued — the joiner side of access lifecycle. |
| CC6.3 | Access modification and removal | Access is modified or removed appropriately on role change, termination, or when no longer required — with periodic reviews. |
| CC6.4 | Physical access | Physical access to facilities housing the system is restricted to authorized personnel (directly or via your datacenter/cloud provider). |
| CC6.5 | Protection against removal | Controls prevent or detect unauthorized removal of confidential information — devices, media, exports. |
| CC6.6 | Transmission and movement | Data transmission and movement is restricted — encryption in transit, approved channels, restricted copy paths. |
| CC6.7 | Data and media handling | Data and media are protected throughout storage, transmission, and disposal per their classification. |
| CC6.8 | Malicious software prevention | Controls prevent or detect unauthorized or malicious software — AV/EDR, allowlisting, and remediation processes. |
CC7 — Common Criteria: System Operations · 5 criteria
| Ref | Criterion | What it covers |
|---|
| CC7.1 | Configuration and vulnerability detection | Configurations and susceptibilities are monitored — vulnerability scanning, baseline drift detection, patch management. |
| CC7.2 | Anomaly monitoring | System components are monitored for anomalies indicative of malicious acts, natural disasters, and errors. |
| CC7.3 | Security event evaluation | Detected events are evaluated to determine whether they are incidents and how to respond. |
| CC7.4 | Incident response | The entity responds to identified security incidents per defined procedures — contain, eradicate, communicate. |
| CC7.5 | Recovery and improvement | Activities to recover from incidents are developed and executed; incidents are reviewed to identify lessons learned. |
CC8 — Common Criteria: Change Management · 1 criteria
| Ref | Criterion | What it covers |
|---|
| CC8.1 | Authorized change | Changes to infrastructure, data, software, and procedures are authorized, designed, developed, configured, documented, tested, approved, and implemented. |
CC9 — Common Criteria: Risk Mitigation · 2 criteria
| Ref | Criterion | What it covers |
|---|
| CC9.1 | Risk mitigation activities | Risk mitigation activities are identified, selected, and developed — mitigation, transfer (e.g., insurance), or formal acceptance. |
| CC9.2 | Vendor and partner risk | Risks from vendors and business partners are assessed and managed — including subservice organizations that appear in your report. |
A1 — Availability · 3 criteria
| Ref | Criterion | What it covers |
|---|
| A1.1 | Capacity management | Current processing capacity is measured and baselined to manage demand and enable availability commitments. |
| A1.2 | Availability commitments and recovery | Environmental protections, backup, and recovery infrastructure/processes support the entity’s availability commitments and recovery objectives. |
| A1.3 | Recovery testing | Recovery plan procedures are tested so restoration actually works when needed — with documented results. |
PI1 — Processing Integrity · 5 criteria
| Ref | Criterion | What it covers |
|---|
| PI1.1 | Processing procedures | Information processing procedures exist so products and services meet objectives — complete, valid, accurate, timely, authorized processing. |
| PI1.2 | Input completeness and accuracy | Inputs are verified for completeness and accuracy before processing — validation, reconciliation, rejection handling. |
| PI1.3 | Processing controls | Processing is controlled for completeness, validity, accuracy, timeliness, and authorization — checkpoints and error handling. |
| PI1.4 | Output accuracy and distribution | Outputs are verified for completeness and accuracy, and distribution is restricted to intended recipients. |
| PI1.5 | Storage of inputs and outputs | Inputs, items in processing, and outputs are stored completely, accurately, and timely — protected for their retention period. |
C1 — Confidentiality · 2 criteria
| Ref | Criterion | What it covers |
|---|
| C1.1 | Identification and retention | Confidential information is identified and maintained, with defined retention and disposal practices for its lifecycle. |
| C1.2 | Disposal | Confidential information is disposed of securely at end of retention — sanitization, destruction, and vendor-held copies. |
P — Privacy (aligned to GAPP) · 9 criteria
| Ref | Criterion | What it covers |
|---|
| P1.0 | Notice and communication | Notice about privacy practices is provided — what personal information is collected, why, and how it is used. |
| P2.0 | Choice and consent | Individuals are offered choices about collection/use, and consent is obtained where required. |
| P3.0 | Collection | Personal information is collected only for the purposes identified in the notice. |
| P4.0 | Use, retention, and disposal | Personal information is used, retained, and disposed of consistent with the notice and commitments. |
| P5.0 | Access | Individuals can access, review, correct, or delete their personal information. |
| P6.0 | Disclosure to third parties | PII is disclosed to third parties only for the purposes identified, with consent where required. |
| P7.0 | Security for privacy | Personal information is protected against unauthorized access — physical and logical. |
| P8.0 | Quality | Personal information is kept accurate, complete, and relevant for its identified purposes. |
| P9.0 | Monitoring and enforcement | Privacy compliance is monitored; complaints and disputes have a defined resolution process. |
Choosing Your Trust Services Categories
Scoping is the first real decision in a SOC 2 program. Security is non-negotiable. Beyond that, your service commitments drive the categories: contractual uptime SLAs pull in Availability; processing financial transactions or shipping deliverables pulls in Processing Integrity; handling customers' sensitive business data under NDA-like commitments pulls in Confidentiality; and processing personal information pulls in Privacy. Adding categories expands the audit's scope, evidence requirements, and cost — most SaaS companies start with Security + Availability and add categories as deals require.
What Auditors Expect to See
For a Type I report, auditors evaluate whether your controls are suitably designed to meet the criteria. For Type II, they must also see evidence the controls operated effectively across the observation window. In practice that means: policies that exist and were approved (CC1–CC5), access review records and deprovisioning tickets (CC6), monitoring dashboards and incident tickets (CC7), change tickets with approvals (CC8), vendor reviews (CC9), and for optional categories the corresponding operational evidence — DR test results (A1.3), reconciliation reports (PI1), disposal logs (C1.2), privacy request records (P5.0). The universal pattern: a defined process plus records showing it ran during the period.
Baseline Yourself in 10 Minutes
Our free SOC 2 Readiness Checker turns this list into a structured questionnaire — answer per criterion, and it produces a readiness score, a prioritized gap list, and a downloadable PDF report, entirely in your browser. Already hold ISO 27001? Most of the Common Criteria map onto Annex A controls — our complete Annex A controls list and ISO 27001 gap analysis show how much of the SOC 2 groundwork is already done.
Frequently Asked Questions
How many Trust Services Criteria are there?
52 in the 2017 TSC: 33 Common Criteria across the CC1–CC9 series, plus 19 additional criteria — 3 Availability, 5 Processing Integrity, 2 Confidentiality, and 9 Privacy. Only the 33 Common Criteria are mandatory for a SOC 2 report; the rest apply only if those categories are in your scope.
Are the Trust Services Criteria the same as controls?
No. Criteria describe desired outcomes; controls are the specific mechanisms you implement to meet them. Two companies can satisfy CC6.1 (logical access) with completely different toolchains. This is the core difference from ISO 27001's Annex A, which names specific controls — SOC 2 auditors evaluate design against the criteria, not conformance to a fixed list.
Which criteria matter most for a first SOC 2?
Auditors find the most exceptions in CC6 (logical access — MFA coverage, access reviews, deprovisioning), CC7 (monitoring and incident response with actual evidence), and CC8 (change management approval trails). A risk register that actually maps risks to controls (CC3/CC5) is the second most common gap — the criteria assume that linkage exists.
Do the criteria map to ISO 27001 or NIST?
Substantially. The AICPA publishes mapping supplements between the TSC, ISO/IEC 27001 Annex A, NIST CSF, and COBIT. CC1–CC5 map onto ISO 27001's organizational/management controls, CC6–CC8 onto its technological controls. If you hold ISO 27001, estimates commonly put 60–80% of Common Criteria coverage as already satisfied by a functioning ISMS — the gaps concentrate in monitoring cadence and evidence formatting.
What changed in the 2017 TSC versus the older principles?
The 2017 revision replaced the legacy Trust Services Principles and Criteria with the CC-series structure aligned to the 2013 COSO framework. Each criterion now carries points of focus describing expected characteristics. The 2022 update revised those points of focus (adding cloud, DevOps, and modern SaaS practice examples) without changing the criteria themselves — the CC1–CC9 numbering is unchanged.
