Security, made up of the common criteria, is in every SOC 2. The other four categories are added when a company's commitments make them relevant. The criteria in force are the 2017 version with points of focus revised in 2022, and a 2027 revision is out as an exposure draft.
The Trust Services Criteria guide covers each category.
Read more
Related terms
- Common criteria
- The common criteria are the SOC 2 Security criteria, numbered CC1 to CC9 in the 2017 version, which apply to every SOC 2 report.
- Points of focus
- Points of focus are the AICPA's descriptions of what a Trust Services Criterion typically covers, used to design controls and judge whether it is met.
- SOC 2
- SOC 2 is an attestation report in which a CPA firm gives an opinion on a service organization's controls against the AICPA Trust Services Criteria.