# Trust services criteria

What a SOC 2 examination tests you against, and which parts you choose.

Source: https://intransic.com/questions/trust-services-criteria

## What does SOC 2 actually require?

It requires you to describe your controls, then be examined against that description. There is no checklist to buy. SOC 2 is built on Trust Services Criteria, and Security is the one every report includes. Availability, Confidentiality, Processing Integrity and Privacy get added if you choose them or a customer demands one. Within that, you write the controls. Your auditor tests what you wrote, not a standard list. This surprises founders expecting a specification. It also means two SOC 2 reports can describe very different systems. Reading the report beats trusting the badge.

Sources:
- [2017 Trust Services Criteria (With Revised Points of Focus – 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) — AICPA & CIMA, read 2026-09-05
- [SOC 2: Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) — AICPA & CIMA, read 2026-09-05
- [Promises of 'fast and easy' threaten SOC credibility](https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/) — Journal of Accountancy, read 2026-09-05

## What are the common criteria?

The security criteria every SOC 2 report addresses, whatever else you add. Security is not optional, so its criteria form the baseline. Your control environment. Communication. Risk assessment. Monitoring. Control activities. Logical and physical access. System operations. Change management. Risk mitigation. Availability, confidentiality, processing integrity and privacy add criteria on top. The criteria are outcome-based rather than prescriptive. They say what must be achieved and leave you to say how, which is why your own control descriptions carry so much weight.

Sources:
- [2017 Trust Services Criteria (With Revised Points of Focus – 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) — AICPA & CIMA, read 2026-09-05
- [Get mappings relevant to the trust services criteria](https://www.aicpa-cima.com/resources/article/get-mappings-relevant-to-the-soc-suite-of-services) — AICPA & CIMA, read 2026-09-05

## Do I need all five trust services categories?

No. Security is the one every report includes, and the rest you add for a reason. Availability suits you if customers hold you to uptime commitments. Confidentiality suits you if you handle information under contractual restriction. Processing integrity suits you if you compute something others rely on. Privacy suits you if you handle personal information and want that examined rather than assumed. Each one you add costs scope, evidence and testing. Add a category because a customer asked or because your product genuinely depends on it, never for completeness.

Sources:
- [2017 Trust Services Criteria (With Revised Points of Focus – 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022) — AICPA & CIMA, read 2026-09-05
- [SOC 2: Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy](https://www.aicpa-cima.com/cpe-learning/publication/soc-2-reporting-on-an-examination-of-controls-at-a-service-organization-relevant-to-security-availability-processing-integrity-confidentiality-or-privacy) — AICPA & CIMA, read 2026-09-05