In the 2017 criteria, CC1 to CC5 follow the COSO internal control principles and CC6 to CC9 cover access, operations, change management and risk mitigation. They are called common because they also underpin the other four categories.
The AICPA's 2027 exposure draft regroups them into eight series and renumbers them, so a criterion ID can point to a different requirement than before. See the article on the 2027 criteria.
Read more
Related terms
- Trust Services Criteria
- The Trust Services Criteria are the AICPA criteria a SOC 2 measures controls against: Security, Availability, Processing Integrity, Confidentiality and Privacy.
- Points of focus
- Points of focus are the AICPA's descriptions of what a Trust Services Criterion typically covers, used to design controls and judge whether it is met.