Sted
Get started
Sted
Get started

LinkedIn Newsletter

Trust Services Criteria

The Trust Services Criteria are the AICPA’s criteria that a SOC 2 auditor measures your controls against. They are grouped into Security, which every report includes, and four optional categories: Availability, Processing Integrity, Confidentiality and Privacy. You choose the optional ones to match what you promise customers.

Clauses
SOC 2 CC1.1 · SOC 2 CC6.1 · SOC 2 CC9.2

Where the term appears

The current text is the 2017 Trust Services Criteria with revised points of focus published in 2022; the criteria themselves did not change in 2022. Security is the 33 common criteria, SOC 2 CC1.1 to SOC 2 CC9.2, and the first five series follow the 17 principles of the COSO 2013 internal control framework. Availability adds three criteria, Confidentiality two, Processing Integrity five and Privacy eight series; the SOC 2 hub paraphrases each series.

Criteria are not controls

A criterion says what must be achieved; the control is how you achieve it. SOC 2 CC6.1 asks for logical access security over the systems and data you protect. Single sign-on with multi-factor authentication and role-based groups would be your controls, and the auditor tests those against the criterion. The points of focus are illustrations that help both sides judge a control, not a checklist you must complete line by line.

How Sted uses it

  • For SOC 2 Sted’s knowledge base carries 33 policies and procedures and 61 record templates mapped to a 51-row catalogue of the trust services criteria: the 33 common criteria, availability, confidentiality and processing integrity criterion by criterion, and the privacy category at series level.
  • Sted’s SOC 2 catalogue holds the privacy category as eight series-level rows, P1.0 to P8.0, rather than as individual criteria, and no policy or record template in Sted’s knowledge base is mapped to them.
  • The SOC 2 privacy criteria are listed on the SoA card but Sted’s knowledge base has nothing to draft for them.
  • SOC 2 report: the report that gives an opinion against these criteria.
  • Control: what you design to meet each criterion.
  • Evidence: what shows a control met its criterion.
  • Annex A: the ISO 27001 control set, often mapped against the common criteria.