Trust Services Criteria: the five categories of SOC 2

What are the Trust Services Criteria?

The Trust Services Criteria are the five categories a SOC 2 report can cover: security, availability, processing integrity, confidentiality and privacy. Security is mandatory; the other four are added by choice.

The SOC 2 Trust Services Criteria are set by the AICPA, and each category contains detailed criteria that your controls have to meet.

The five Trust Services Criteria

Here is the Trust Services Criteria list, with what each category covers:

  • Security: protection against unauthorised access; the foundation of every report.
  • Availability: systems are available for operation and use as committed.
  • Processing integrity: processing is complete, accurate, timely and authorised.
  • Confidentiality: information designated as confidential is protected.
  • Privacy: personal information is collected, used, kept and disposed of properly.

Why security is always included

The security criteria in SOC 2, also called the common criteria, apply to every report. They cover access control, change management, risk assessment, monitoring and incident response, which is why most of the work in any SOC 2 project sits there.

Which Trust Services Criteria to include

Include what your customers rely on and nothing more, because every extra category adds controls and evidence. A data platform with uptime commitments adds availability; a company holding customer secrets adds confidentiality; privacy is usually only added when processing personal data is central to the service.

Last reviewed 2026-11-01.

Related terms

  • SOC 2 Type II — SOC 2 Type II is an independent audit report, under the AICPA’s SOC 2 framework, on whether a company’s security controls actually operated effectively over a period of time, usually three to twelve months.
  • Control — A security control is a specific safeguard a company puts in place to manage a risk, such as revoking a leaver’s access within 24 hours, and that an auditor can ask you to prove is working.
  • Evidence — Compliance evidence is the record that proves a control actually operated: a log export, a signed policy, a closed ticket, a dated screenshot.

All glossary terms →