[Company] system description: [system name]
Period covered: [start date] to [end date] (Type 2) or as of [date] (Type 1).
Trust services categories in scope: [Security, plus Availability, Confidentiality, Processing Integrity or Privacy where included].
1. Services provided
What the system does for customers, in a paragraph a buyer can read. Name products and tiers in scope, and any that are not.
[Company] provides [service] to [type of customers]. The system in scope is [product or platform name], which [what it does].
Out of scope: [products, regions or services not covered by this report].
2. Principal service commitments and system requirements
What you promise customers (contracts, SLAs, security pages) and the requirements you set yourself to keep those promises.
- Commitments to customers: [e.g. uptime target, data residency, encryption, breach notification within a set time].
- Where they are made: [master services agreement, DPA, SLA, public security page].
- System requirements that support them: [e.g. backups every N hours, access reviews quarterly, incidents triaged within N hours].
3. Components of the system
The five components the description criteria ask for. Describe each as it is during the period.
Infrastructure: [cloud provider and regions, networks, environments in scope].
Software: [applications, databases, internal tools and third-party services that process customer data].
People: [teams and roles that run the system, e.g. engineering, security, support, leadership].
Procedures: [how access, change, monitoring, incident response and vendor management are carried out].
Data: [what customer data the system holds, where it is stored, how it moves and how long it is kept].
4. Boundaries of the system
Where the system starts and stops, including what customers and vendors operate.
The system boundary includes [components]. It excludes [components operated by customers or vendors].
5. Relevant aspects of the control environment
Governance, risk assessment, information and communication, and monitoring: the CC1 to CC5 side of the criteria.
- Governance and oversight: [board or equivalent, security owner, reporting lines].
- Risk assessment: [how often, who runs it, how risks are treated].
- Information and communication: [policies, training, customer communication channels].
- Monitoring: [continuous monitoring, internal reviews, penetration tests].
6. Subservice organisations
Vendors whose controls the system depends on. Say whether each is carved out (its controls are excluded and you rely on its own report) or included.
| Subservice organisation | Service provided | Method | Controls expected of it |
|---|---|---|---|
| [Cloud provider] | [Hosting] | [Carve-out] | [Physical security, environmental controls] |
7. Complementary user entity controls
Controls the report assumes your customers operate. Keep the list short and real.
- Customers are responsible for [managing their own users' access to the service].
- Customers are responsible for [the security of credentials and API keys issued to them].
- Customers are responsible for [reviewing audit logs made available to them].
8. Criteria not relevant to the system
Any criterion in scope that does not apply, with the reason. Leave the section in with 'None' if every criterion applies.
[Criterion]: not relevant because [reason, e.g. the company operates no physical data centre].
9. Significant changes and incidents during the period
Changes to the system, and incidents that came from controls not designed or operating as described.
Changes: [e.g. migration to a new region, new identity provider, acquisition].
Incidents: [none, or a description of the incident and how it was resolved].
