# Trust Services Criteria

The AICPA criteria a SOC 2 auditor measures your controls against, grouped into Security and four optional categories.

Source: https://sted.digital/docs/glossary/trust-services-criteria · Last reviewed 17 October 2026 · Strand Glossary

The Trust Services Criteria are the AICPA's criteria that a SOC 2 auditor measures your controls against. They are grouped into Security, which every report includes, and four optional categories: Availability, Processing Integrity, Confidentiality and Privacy. You choose the optional ones to match what you promise customers.

## Where the term appears

The current text is the 2017 Trust Services Criteria with revised points of focus published in 2022; the criteria themselves did not change in 2022. Security is the 33 common criteria, SOC 2 CC1.1 to SOC 2 CC9.2, and the first five series follow the 17 principles of the COSO 2013 internal control framework. Availability adds three criteria, Confidentiality two, Processing Integrity five and Privacy eight series; the [SOC 2 hub](/docs/standards/soc-2) paraphrases each series.

### Criteria are not controls

A criterion says what must be achieved; the control is how you achieve it. SOC 2 CC6.1 asks for logical access security over the systems and data you protect. Single sign-on with multi-factor authentication and role-based groups would be your controls, and the auditor tests those against the criterion. The points of focus are illustrations that help both sides judge a control, not a checklist you must complete line by line.

## How Sted uses it

For SOC 2 Sted's knowledge base carries 33 policies and procedures and 61 record templates mapped to a 51-row catalogue of the trust services criteria: the 33 common criteria, availability, confidentiality and processing integrity criterion by criterion, and the privacy category at series level.
Sted's SOC 2 catalogue holds the privacy category as eight series-level rows, P1.0 to P8.0, rather than as individual criteria, and no policy or record template in Sted's knowledge base is mapped to them.
The SOC 2 privacy criteria are listed on the SoA card but Sted's knowledge base has nothing to draft for them.

## Related terms

- [SOC 2 report](/docs/glossary/soc-2-report): the report that gives an opinion against these criteria.
- [Control](/docs/glossary/control): what you design to meet each criterion.
- [Evidence](/docs/glossary/evidence): what shows a control met its criterion.
- [Annex A](/docs/glossary/annex-a): the ISO 27001 control set, often mapped against the common criteria.