Library
SOC 2, the trust services criteria
AICPA · 2017
Criteria a service organisation is audited against so it can hand customers a report on its controls. Security is always in scope; availability, confidentiality, processing integrity and privacy are added by choice.
Who this applies to
Contractual, never legal. No statute in the European Union or the United States requires it. The trigger is a customer asking for the report, and in practice that customer is usually a United States buyer of a software or hosting service, where it is the usual expectation of any service organisation that handles customer data.
It is an attestation report, not a certification. A licensed certified public accountant (CPA) firm examines the service organisation under the attestation standards of the American Institute of Certified Public Accountants and gives an opinion; there is no certificate, and the opinion can be qualified where controls fell short. Who signed the report is therefore the first thing to check.
Security is always in scope. Availability, confidentiality, processing integrity and privacy are added by choice, and a report covering only security is normal rather than deficient. What buyers actually distinguish is the type: a Type 1 report describes whether the controls were designed appropriately at a point in time, while a Type 2 report covers whether they operated over a period, commonly three to twelve months. A Type 1 report answers a different question from the one most procurement teams are asking.
The 2017 trust services criteria remain current. The points of focus beneath them were revised in 2022, which changed what an auditor looks for without changing the criteria themselves.
For a software company the practical position is regional. Selling into the United States produces requests for this report; selling into the European Union produces requests for an ISO/IEC 27001 certificate. Companies selling into both end up carrying both, and the two rest on largely the same controls described twice — which is the overlap this library exists to make cheaper.
What is in it
- Security Security
- CC1 Control environment
- CC1.1 The entity demonstrates a commitment to integrity and ethical values.
- CC1.2 The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.
- CC1.3 Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.
- CC1.4 The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.
- CC1.5 The entity holds individuals accountable for their internal control responsibilities in the pursuit of objectives.
- CC2 Information and communication
- CC2.1 The entity obtains or generates and uses relevant, quality information to support the functioning of internal control.
- CC2.2 The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.
- CC2.3 The entity communicates with external parties regarding matters affecting the functioning of internal control.
- CC3 Risk assessment
- CC3.1 The entity specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.
- CC3.2 The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.
- CC3.3 The entity considers the potential for fraud in assessing risks to the achievement of objectives.
- CC3.4 The entity identifies and assesses changes that could significantly impact the system of internal control.
- CC4 Monitoring activities
- CC4.1 The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.
- CC4.2 The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.
- CC5 Control activities
- CC5.1 The entity selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.
- CC5.2 The entity also selects and develops general control activities over technology to support the achievement of objectives.
- CC5.3 The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.
- CC6 Logical and Physical Access Controls
- CC6.1 The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.
- CC6.2 Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.
- CC6.3 The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity’s objectives.
- CC6.4 The entity restricts physical access to facilities and protected information assets (for example, data center facilities, backup media storage, and other sensitive locations) to authorized personnel to meet the entity’s objectives.
- CC6.5 The entity discontinues logical and physical protections over physical assets only after the ability to read or recover data and software from those assets has been diminished and is no longer required to meet the entity’s objectives.
- CC6.6 The entity implements logical access security measures to protect against threats from sources outside its system boundaries.
- CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity’s objectives.
- CC6.8 The entity implements controls to prevent or detect and act upon the introduction of unauthorized or malicious software to meet the entity’s objectives.
- CC7 System Operations
- CC7.1 To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.
- CC7.2 The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.
- CC7.3 The entity evaluates security events to determine whether they could or have resulted in a failure of the entity to meet its objectives (security incidents) and, if so, takes actions to prevent or address such failures.
- CC7.4 The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate.
- CC7.5 The entity identifies, develops, and implements activities to recover from identified security incidents.
- CC8 Change Management
- CC9 Risk Mitigation
- CC1 Control environment
- Availability Availability
- A1 Additional criteria for availability
- A1.1 The entity maintains, monitors, and evaluates current processing capacity and use of system components (infrastructure, data, and software) to manage capacity demand and to enable the implementation of additional capacity to help meet its objectives.
- A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data backup processes, and recovery infrastructure to meet its objectives.
- A1.3 The entity tests recovery plan procedures supporting system recovery to meet its objectives.
- A1 Additional criteria for availability
- Confidentiality Confidentiality
- Processing Integrity Processing Integrity
- PI1 Additional criteria for processing integrity (over the provision of services or the production, manufacturing, or distribution of goods)
- PI1.1 The entity obtains or generates, uses, and communicates relevant, quality information regarding the objectives related to processing, including definitions of data processed and product and service specifications, to support the use of products and services.
- PI1.2 The entity implements policies and procedures over system inputs, including controls over completeness and accuracy, to result in products, services, and reporting to meet the entity’s objectives.
- PI1.3 The entity implements policies and procedures over system processing to result in products, services, and reporting to meet the entity’s objectives.
- PI1.4 The entity implements policies and procedures to make available or deliver output completely, accurately, and timely in accordance with specifications to meet the entity’s objectives.
- PI1.5 The entity implements policies and procedures to store inputs, items in processing, and outputs completely, accurately, and timely in accordance with system specifications to meet the entity’s objectives.
- PI1 Additional criteria for processing integrity (over the provision of services or the production, manufacturing, or distribution of goods)
- Privacy Privacy
- P1 Privacy Criteria Related to Notice and Communication of Objectives Related to Privacy
- P2 Privacy Criteria Related to Choice and Consent
- P3 Privacy Criteria Related to Collection
- P3.1 Personal information is collected consistent with the entity’s objectives related to privacy.
- P3.2 For information requiring explicit consent, the entity communicates the need for such consent as well as the consequences of a failure to provide consent for the request for personal information and obtains the consent prior to the collection of the information to meet the entity’s objectives related to privacy.
- P4 Privacy Criteria Related to Use, Retention, and Disposal
- P4.1 The entity limits the use of personal information to the purposes identified in the entity’s objectives related to privacy.
- P4.2 The entity retains personal information consistent with the entity’s objectives related to privacy.
- P4.3 The entity securely disposes of personal information to meet the entity’s objectives related to privacy.
- P5 Privacy Criteria Related to Access
- P5.1 The entity grants identified and authenticated data subjects the ability to access their stored personal information for review and, upon request, provides physical or electronic copies of that information to data subjects to meet the entity’s objectives related to privacy. If access is denied, data subjects are informed of the denial and reason for such denial, as required, to meet the entity’s objectives related to privacy.
- P5.2 The entity corrects, amends, or appends personal information based on information provided by data subjects and communicates such information to third parties, as committed or required, to meet the entity’s objectives related to privacy. If a request for correction is denied, data subjects are informed of the denial and reason for such denial to meet the entity’s objectives related to privacy.
- P6 Privacy Criteria Related to Disclosure and Notification
- P6.1 The entity discloses personal information to third parties with the explicit consent of data subjects and such consent is obtained prior to disclosure to meet the entity’s objectives related to privacy.
- P6.2 The entity creates and retains a complete, accurate, and timely record of authorized disclosures of personal information to meet the entity’s objectives related to privacy.
- P6.3 The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity’s objectives related to privacy.
- P6.4 The entity obtains privacy commitments from vendors and other third parties who have access to personal information to meet the entity’s objectives related to privacy. The entity assesses those parties’ compliance on a periodic and as-needed basis and takes corrective action, if necessary.
- P6.5 The entity obtains commitments from vendors and other third parties with access to personal information to notify the entity in the event of actual or suspected unauthorized disclosures of personal information. Such notifications are reported to appropriate personnel and acted on in accordance with established incident-response procedures to meet the entity’s objectives related to privacy.
- P6.6 The entity provides notification of breaches and incidents to affected data subjects, regulators, and others to meet the entity’s objectives related to privacy.
- P6.7 The entity provides data subjects with an accounting of the personal information held and disclosure of the data subjects’ personal information, upon the data subjects’ request, to meet the entity’s objectives related to privacy.
- P7 Privacy Criteria Related to Quality
- P8 Privacy Criteria Related to Monitoring and Enforcement
Criterion text: 2017 Trust Services Criteria (with revised points of focus, 2022). © 2022 Association of International Certified Professional Accountants. All rights reserved. COSO principles © 2019 Committee of Sponsoring Organizations of the Treadway Commission (COSO). All rights reserved. Reproduced from copies of AICPA's published text; check it against AICPA's own before relying on it.