Question 1

What does SOC 2 actually require?

Accepted Answer

It requires you to describe your controls, then be examined against that description. There is no checklist to buy. SOC 2 is built on Trust Services Criteria, and Security is the one every report includes. Availability, Confidentiality, Processing Integrity and Privacy get added if you choose them or a customer demands one. Within that, you write the controls. Your auditor tests what you wrote, not a standard list. This surprises founders expecting a specification. It also means two SOC 2 reports can describe very different systems. Reading the report beats trusting the badge.

Question 2

What are the common criteria?

Accepted Answer

The security criteria every SOC 2 report addresses, whatever else you add. Security is not optional, so its criteria form the baseline. Your control environment. Communication. Risk assessment. Monitoring. Control activities. Logical and physical access. System operations. Change management. Risk mitigation. Availability, confidentiality, processing integrity and privacy add criteria on top. The criteria are outcome-based rather than prescriptive. They say what must be achieved and leave you to say how, which is why your own control descriptions carry so much weight.

Question 3

Do I need all five trust services categories?

Accepted Answer

No. Security is the one every report includes, and the rest you add for a reason. Availability suits you if customers hold you to uptime commitments. Confidentiality suits you if you handle information under contractual restriction. Processing integrity suits you if you compute something others rely on. Privacy suits you if you handle personal information and want that examined rather than assumed. Each one you add costs scope, evidence and testing. Add a category because a customer asked or because your product genuinely depends on it, never for completeness.