By Editorial team · Published · Last updated
What the five Trust Services Criteria are, why Security is the only mandatory category, and how the 2017 criteria with 2022 points of focus actually get applied.
The Trust Services Criteria (TSC) are the AICPA-published rubric every SOC 2 examination is graded against. They tell auditors what they're looking for and tell service organizations what they have to demonstrate. Five categories — Security, Availability, Processing Integrity, Confidentiality, Privacy — cover roughly 60 criteria in total, plus several hundred 'points of focus' that describe how a control might satisfy each criterion.
Security is mandatory in every SOC 2. The other four are optional and added based on what your service actually does and what your customers care about.
Most criteria in the Security category — risk assessment, monitoring, change management — apply equally to the other four categories. Rather than restating those criteria four more times, the AICPA designates the Security criteria as 'common' and reuses them. If you add Availability to your scope, the Availability-specific criteria (A1.1, A1.2, A1.3) layer on top of the common criteria; you don't re-test risk assessment for Availability separately.
The criteria themselves haven't changed since 2017. What changed in 2022 was the 'points of focus' — the implementation guidance attached to each criterion. The AICPA refreshed points of focus to address modern concerns: cloud configuration, third-party risk, vendor concentration, ransomware, and remote workforce considerations. The criteria are stable; the supporting guidance is current.
Points of focus are not a checklist. The AICPA explicitly notes that not every point of focus is relevant for every service organization, and meeting them is not required to pass an examination. They are illustrative — examples of what 'meeting' a criterion might look like.
This is where many founders get confused. The TSC don't tell you which controls to implement. They tell you what control objectives the system has to achieve. You — with your auditor and (often) your compliance platform — design the actual controls that map to each criterion. CC6.1 ('logical access security software, infrastructure, and architectures over protected information assets') might be satisfied by some combination of MFA, role-based access, SSO, and quarterly access reviews. The auditor evaluates whether your specific controls, as designed and operated, are reasonable.