Which Trust Services Categories should our SOC 2 report cover?

Start

A customer has asked for SOC 2 and we must choose what it covers

A SOC 2 report examines one system against the Trust Services Criteria, which sit in five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. You choose the categories, and each one adds criteria and evidence, so choose by the commitments you have made.

• Then: Start from Security, which every report includes

Step

Start from Security, which every report includes

Security is not a question. The AICPA's common criteria CC1 to CC9 apply to all five categories, so a report on any category includes them. They are the 33 Security criteria, out of 61 in all. The other four categories are added only where a customer or a written commitment needs them.

• Then: Gather the contracts, service levels and customer requests

Step

Gather the contracts, service levels and customer requests

Read what customers asked for in their security reviews, the service levels and other written commitments, and the terms of service. For each category the question is whether a customer or contract requires it, or you make a written commitment. Legal reads the contracts. Record the clause or request that decides each answer.

• Then: Is Availability required by a customer, or promised in writing?

Decision

Is Availability required by a customer, or promised in writing?

Availability fits when customers depend on the service being up and your contracts or service levels commit to uptime or recovery. It holds 3 criteria. If you do not know what your contracts say, answer yes for now and have Legal confirm, then take it out if no commitment is found.

• Yes, or not known: Add Availability, and record the clause behind it
• No: Is Confidentiality required, or promised in writing?

Step

Add Availability, and record the clause behind it

Write down the contract clause or service level that needs it. The readiness item on backups and a tested restore applies once Availability is in scope, so the recovery records are part of what you keep.

• Then: Is Confidentiality required, or promised in writing?

Decision

Is Confidentiality required, or promised in writing?

Confidentiality fits when you hold customers' confidential information, which is not personal information, and your contracts commit to protecting, retaining or deleting it. It holds 2 criteria. In the pack's worked example a written commitment to delete customer data after the contract ends added it.

• Yes, or not known: Add Confidentiality, and record the clause behind it
• No: Is Processing Integrity required, or promised in writing?

Step

Add Confidentiality, and record the clause behind it

Write down the contract clause or published term that needs it, such as a retention or deletion commitment. The description of the system must then agree with the contract language.

• Then: Is Processing Integrity required, or promised in writing?

Decision

Is Processing Integrity required, or promised in writing?

Processing Integrity fits when customers rely on your processing being complete, accurate and timely, for example payments, payroll or calculations, and your contracts commit to it. It holds 5 criteria. Revisit it when a customer asks or a contract adds a commitment on accuracy.

• Yes, or not known: Add Processing Integrity, and record the clause behind it
• No: Is Privacy required, or promised in writing?

Step

Add Processing Integrity, and record the clause behind it

Write down the contract clause or request that needs it. It adds criteria and evidence about the accuracy, completeness and timeliness of your processing.

• Then: Is Privacy required, or promised in writing?

Decision

Is Privacy required, or promised in writing?

Privacy fits when you collect, use, keep or disclose personal information on customers' behalf or from their users, and customers ask you to report on how you handle it. It holds 18 criteria. In the pack's worked example, holding only business contact details of customers' staff, with no request for a report, did not add it.

• Yes, or not known: Add Privacy, and record the request or clause behind it
• No: Count the criteria the choice brings in

Step

Add Privacy, and record the request or clause behind it

Write down the request or written commitment that needs it. Where Privacy is in scope the description also states your role over personal information, for example processor or controller.

• Then: Count the criteria the choice brings in

Step

Count the criteria the choice brings in

The criteria in scope are Security's 33, which are always counted, plus those of each other category chosen: Security 33, Availability 3, Confidentiality 2, Processing Integrity 5, Privacy 18. A criterion inside a chosen category that does not apply needs a reason that is a fact about the system, and the CPA firm decides whether it stands. A preference or a cost is not a reason.

• Then: Do customers ask for different categories?

Decision

Do customers ask for different categories?

Two customers may ask for different things. The pack's advice for a customer-driven organisation is to answer for the one report you will commission, and to record what each customer asked, so the sponsor can see which request that report does not serve.

• Yes: Choose the one report and record which request it leaves out
• No: Does the executive sponsor agree the categories?

Step

Choose the one report and record which request it leaves out

Record for each customer what it asked for, and which of those requests the report you are commissioning does not serve. Then say so to that customer plainly. Which report a customer accepts is for the customer to say.

• Then: Does the executive sponsor agree the categories?

Decision

Does the executive sponsor agree the categories?

The executive sponsor decides scope questions that cost money, and each category adds criteria and evidence to keep. Show the sponsor the categories, the commitment or customer behind each, and the count of criteria.

• Yes: Fix the categories with the CPA firm in writing
• No, or not yet asked: Take it back to the sponsor with the cost of each category

Outcome

Fix the categories with the CPA firm in writing

Record each category with the commitment or customer that needs it, then confirm the type, categories and dates with the CPA firm before you commit to a customer. Reassess when a customer asks for a category you left out or drops one, or when a customer commitment changes.

Outcome

Take it back to the sponsor with the cost of each category

Without the sponsor's agreement the scope is not settled. The pack's advice to a small team is to keep the scope narrow, with Security alone and a category added only on a written request. Return with what each category adds and the customer or commitment behind it.