They are guidance, not requirements: no single point of focus requires a specific control, and a company can meet a criterion without addressing every one. In practice auditors use them to decide what to ask about.
The 2022 update revised the points of focus without changing the criteria, and the 2027 exposure draft adds points of focus on AI and automation.
Read more
Related terms
- Trust Services Criteria
- The Trust Services Criteria are the AICPA criteria a SOC 2 measures controls against: Security, Availability, Processing Integrity, Confidentiality and Privacy.
- Common criteria
- The common criteria are the SOC 2 Security criteria, numbered CC1 to CC9 in the 2017 version, which apply to every SOC 2 report.