The AICPA has published an exposure draft of the 2027 SOC 2 Trust Services Criteria, the first rewrite of the criteria themselves since 2017. Comments are due by 15 January 2027, and if the draft is issued as final it applies to SOC 2 engagements beginning on or after 31 December 2027, with early adoption permitted.
The 2022 update only revised the points of focus and left the 2017 criteria intact. This time the AICPA's Assurance Services Executive Committee has restructured the criteria and given them new numbers, and it has written AI and automation into the points of focus across almost every series. The committee names two goals for the work, a simpler and more usable report and criteria that fit systems where software now makes decisions that used to need a person.
For any organization planning a SOC 2 report in the next two years, this changes how controls should be designed and mapped today. SOC 2 is technically an attestation report issued by a CPA firm, though most buyers and sellers call it a certification and this post does the same.
Fewer criteria, and new numbers for the ones that remain
The common criteria shrink from 33 to 20. In the 2017 version the first five series followed the 17 principles of the COSO internal control framework, and the operational series CC6 to CC9 were added on top as supplemental criteria. The 2027 draft removes the COSO mapping completely and regroups the common criteria into eight series named after the work they cover.
| Series | 2027 draft name | Criteria |
|---|---|---|
| CC1 | Control environment | 2 |
| CC2 | Information and communication | 2 |
| CC3 | Risk assessment | 3 |
| CC4 | Monitoring activities | 1 |
| CC5 | Logical and physical asset protection | 6 |
| CC6 | System operations | 2 |
| CC7 | System development and change management | 3 |
| CC8 | Vendor management | 1 |
Because of the renumbering, a criterion ID now often points at a different requirement than it did in 2017. CC6.1 used to mean logical access security and now means monitoring system components for anomalies, while logical access has moved to CC5.1. Any control matrix, policy cross-reference or tool mapping keyed to 2017 IDs will need a fresh mapping.
Several topics also get criteria of their own:
- Change management splits by type of change, with CC7.1 for infrastructure, CC7.2 for acquired software and CC7.3 for internally developed applications.
- Vendor management becomes its own series (CC8.1). Its points of focus cover tiering vendors, looking at your vendors' own vendors, reviewing subservice SOC reports and their complementary controls, and exit procedures such as verified data return and deletion.
- Encryption (CC5.5) and vulnerability management (CC5.6) are now stand-alone criteria. CC5.5 also asks for periodic reassessment of algorithms, key lengths and key management against the threat environment.
- Risk management is described as a full program in CC3.1 to CC3.3, with defined risk appetite, a governance owner, an up-to-date risk register and independent assessment of the program itself.
- Availability adds A1.4 for resilience and recovery testing, including restores from air-gapped or immutable backups after a ransomware scenario. Confidentiality grows from two criteria to three, with classification and inventory of confidential data now a criterion of its own (C1.1).
The privacy series keeps its P1 to P8 structure and its markers for which points of focus typically apply to a data controller and which to a data processor. The 2017 criteria stay in force for SOC for Cybersecurity and SOC for Supply Chain engagements, so the 2027 version is specific to SOC 2 and SOC 3.
AI and automation run through almost every series
The draft adds points of focus for emerging technologies and AI across the common criteria and the processing integrity and privacy series. The committee chose to keep the criteria technology-neutral and put the AI-specific detail in the points of focus, and it says separate guidance on applying the criteria to systems with AI components is being developed.
| Criterion | What the draft adds |
|---|---|
| CC1.2 | Competency training that accounts for new and maturing technologies such as AI |
| CC2.2 | Users are told when an output is AI-generated, and given guidance where a person validates AI output |
| CC3.2 | Risk assessment covers training data manipulation, adversarial inputs, model misuse, bias, prompt manipulation and data poisoning |
| CC3.3 | The risk framework is recalibrated for model drift, lack of explainability and blockchain components |
| CC5.1 | Access control considers robotic process automation and AI agents, and access reviews look for AI or other technology accounts that do not need access |
| CC5.3 | Controls to detect unsanctioned AI platforms and unauthorized AI tools and models in the environment |
| CC5.6 | Mitigation of prompt injection, jailbreak chaining and data poisoning, plus AI-assisted vulnerability scanning |
| CC6.1 | Monitoring AI components for drift, bias amplification, unexpected outputs and malicious prompts |
| CC7.2, CC7.3 | Where you can train a model, changes to training and fine-tuning data are authorized, validated and protected |
| CC8.1 | Third-party AI models, APIs and plugins are evaluated before use and as they change |
| A1.1 | Protection against resource exhaustion from excessive API calls or AI prompts |
| PI1.1 to PI1.4 | Data lineage and provenance for model inputs, pre-deployment validation and bias testing, output monitoring with human review or override |
| P4.1 | Personal information is not improperly retained or exposed by AI models |
Points of focus are guidance for management and the auditor, and the draft states plainly that no point of focus requires a specific control. In practice auditors use them to decide what to ask about. A company that runs AI agents with production access should expect questions about how those agents get their access and how that access is reviewed, even if the criterion text never names AI.
The change management criteria are worth reading closely for teams that ship code with coding agents. CC7.2 and CC7.3 expect segregation of responsibilities when deploying changes, including restricting or monitoring unilateral development and deployment by a single user. They also ask for periodic review of the configuration of pipelines and branches, and CC7.3 extends life-cycle management to approved code dependencies and externally sourced components. When an agent writes the code and opens the pull request, the evidence that a separate person approved it has to come from somewhere.
When the 2027 criteria apply to your report
| Date | What happens |
|---|---|
| 27 October 2026 | Exposure draft published, with a clean and a redlined version |
| 15 January 2027 | Public comment period closes |
| To be announced | Final criteria issued, possibly with changes from the comment period |
| 31 December 2027 | Effective for SOC 2 engagements beginning on or after this date |
Most reports issued during 2027 will still be measured against the 2017 criteria. Once the final version is out, a company can choose to adopt it early. A Type 2 report covers a period of operation, often six or twelve months, so a period that straddles the effective date is a question to settle with your auditor well in advance.
The draft is still open for comment and the text can move before it is final. Treat the individual points of focus as provisional until the final version is published, and expect your auditor to do the same.
What to do now
| Your situation | What to do |
|---|---|
| First SOC 2 report planned for 2027 | Your audit will most likely run on the 2017 criteria. Describe each control by the outcome it achieves and keep the criterion mapping as a separate layer, so the same control set can be mapped to the 2027 structure later with no redesign. |
| Existing SOC 2, renewing every year | Plan the switch for the first audit period that starts after 31 December 2027. Budget time to remap your control matrix, since many criterion IDs now point to different requirements. |
| AI features in your product, or AI tools used internally | Build an inventory of AI components, third-party models and the accounts AI agents use. Start keeping evidence for drift monitoring and for how users learn that an output is AI-generated. |
| Engineering teams working with coding agents | Check that your change process still shows a separate human approver when an agent authors the change, and that access to pipeline and branch configuration is restricted and reviewed. |
| Heavy reliance on cloud and SaaS vendors | Tier your vendors and start collecting their SOC reports now, together with the complementary controls each report expects you to run. CC8.1 also asks for defined exit procedures. |
| Views on the draft you want heard | Send comments to the AICPA by 15 January 2027. The address is in the exposure draft, and the redlined version shows every change against 2017. |
In each of these cases it helps to tie controls to what your systems actually do and to keep the evidence close to where the work happens. Evidence taken straight from code and infrastructure can be pointed at a new numbering quickly. Screenshots collected by hand for a 2017 criterion usually have to be gathered again once the framework changes.
How Noru approaches the transition
Noru is built on the idea that compliance evidence should be verified from the systems themselves. Our agents read the evidence that already exists in your code and infrastructure and connect it to the criteria it supports, so a new criteria structure means updating that connection while the underlying evidence stays where it is. The 2027 draft's focus on agents, model changes and segregation of duties in deployment pipelines overlaps closely with the problems Noru was built to handle for teams that ship software with AI in the loop.
If you are planning a SOC 2 report for 2027 or 2028 and want to see how your current controls map to the draft, get in touch with us at noru.tech.
Sources
- AICPA Exposure Drafts: Proposed 2027 SOC 2 Trust Services Criteria and Description Criteria, AICPA & CIMA, October 2026 (free account required)
- 2017 Trust Services Criteria (With Revised Points of Focus, 2022), AICPA & CIMA