Trust Services Criteria Response Register

Lists the 61 Trust Services Criteria by number and series title, with blank columns for your own controls, owners and evidence. It makes no coverage claim.

Available soon

Format: Excel
Size: 65 KB
Length: 12 sheets
Version: 1.1
Updated: 18 Oct 2026

Follow this documentFree account. We can email you when it changes.

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	What this is. The Trust Services Criteria Response Register of the SOC 2 Report Readiness pack: a list, not a mapping, with no coverage claim (see the Cover). You write the controls, owners and evidence. Read each criterion in the Library.
2	Categories sheet. Answer Yes or No for the four categories other than Security, from the outcome of the SOC 2 Report Scoping Assessment. Security is Yes by default (SR-03).
3	Register, In scope? (RG-04). Answer Yes, No or Not relevant for every criterion. A criterion in a category set to No is marked No.
4	Reason (RG-05). Every No and Not relevant needs one: a fact about the system, such as a thing you do not own or a commitment you do not make. A preference or a cost is not a reason (Criteria that are not relevant, and why, DC-8). The CPA firm decides whether it stands, so ask before you rely on it.
5	Controls (RG-06). For a Yes, write your own controls by the IDs of your control inventory (P20-A03 Control Inventory & Ownership Register). One criterion may have several controls, and one control may appear against several criteria. The pairing is your own judgement.
6	Owner (RG-07) and Evidence (RG-08). Name one person, the record the control leaves and the system that holds it. Evidence made up afterwards is not evidence (SR-09). The Control Owner & Evidence Plan takes each control further.
7	Status (RG-09). Not started, Planned, In place, Operating, as defined on the Definitions sheet. The SOC 2 Readiness Self-Assessment uses the same four.
8	Notes (RG-10) and Row check. Notes hold gaps, exceptions, the controls you assume a provider operates and questions for the CPA firm. Row check names the first thing missing from a row. It checks that a row is filled in, not that the control is good.
9	Summary and Checks. The Summary counts criteria by category and status. Each of the nine checks says Clear, Action needed or Nothing to check. Settle each Action needed before the readiness assessment (Readiness Assessment Procedure). Counts are not a score (SR-15).
10	Update the register when the scope, a control, an owner or a provider changes (SR-08).

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps an organisation get ready for a SOC 2 examination by a licensed CPA firm. It is not legal advice and not advice on an audit or attestation engagement. A SOC 2 report is the CPA firm's opinion on management's description of a system and on its controls. It is an attestation, not a certificate. This document does not say that you will receive any particular opinion, that any control meets a criterion, or that holding ISO/IEC 27001 or any other report equals or replaces a SOC 2 report. What the criteria require of you, how exceptions are described in the report and whether they affect the opinion are for the CPA firm to decide. Which customers accept which report is for them.

A row filled in records what you say you do. It is not a finding, and an empty row is not a failure.

EXAMPLE: Acme Corp (EXAMPLE). The Example sheet shows ten of its rows, all invented. Delete the sheet before you rely on the workbook.

Adapting this template:

• Small organisation: one person may own most controls. Name that person in every row they own, keep every criterion in the register, and say in Notes where one control is stretched across several.

• Regulated or customer-driven organisation: when a customer's contract names a criterion or a category, say in Notes which customer asked. Counsel confirms what the contract binds you to. The register records your answers and does not interpret the contract.

• Organisation that uses outsourced providers: for each provider that runs part of the system, write in Notes the controls you assume it operates, or the report you rely on. Do not mark a row Operating on a provider's report alone. Your own monitoring of the provider is the control that is yours (SR-06).

• Replace every [[placeholder]] with your own text. Keep the formulas.

Category	Criteria in the Register (calc)	In scope?	Reason or where it was decided
Security	33	Yes	In scope by default (SR-03).
Availability	3
Confidentiality	2
Processing Integrity	5
Privacy	18

Register

This register is a list, not a mapping. It lists the Trust Services Criteria by number and series title so that you can write down your own controls, owners and evidence against each. It does not say which of your controls address which criterion, and it does not say that any control meets a criterion. Only the CPA firm forms an opinion on that. Read each criterion in the Library.

Criterion	Series title	Category	In scope?	Reason if not in scope or not relevant	Your control or controls	Control owner	Evidence	Status	Notes	Row check (calc)
RG-01	RG-02	RG-03	RG-04	RG-05	RG-06	RG-07	RG-08	RG-09	RG-10	calc
CC1.1	Control Environment	Security								Enter In scope?
CC1.2	Control Environment	Security								Enter In scope?
CC1.3	Control Environment	Security								Enter In scope?
CC1.4	Control Environment	Security								Enter In scope?
CC1.5	Control Environment	Security								Enter In scope?
CC2.1	Information and Communication	Security								Enter In scope?
CC2.2	Information and Communication	Security								Enter In scope?
CC2.3	Information and Communication	Security								Enter In scope?
CC3.1	Risk Assessment	Security								Enter In scope?
CC3.2	Risk Assessment	Security								Enter In scope?
CC3.3	Risk Assessment	Security								Enter In scope?
CC3.4	Risk Assessment	Security								Enter In scope?
CC4.1	Monitoring Activities	Security								Enter In scope?
CC4.2	Monitoring Activities	Security								Enter In scope?
CC5.1	Control Activities	Security								Enter In scope?
CC5.2	Control Activities	Security								Enter In scope?
CC5.3	Control Activities	Security								Enter In scope?
CC6.1	Logical and Physical Access Controls	Security								Enter In scope?
CC6.2	Logical and Physical Access Controls	Security								Enter In scope?
CC6.3	Logical and Physical Access Controls	Security								Enter In scope?
CC6.4	Logical and Physical Access Controls	Security								Enter In scope?
CC6.5	Logical and Physical Access Controls	Security								Enter In scope?
CC6.6	Logical and Physical Access Controls	Security								Enter In scope?
CC6.7	Logical and Physical Access Controls	Security								Enter In scope?
CC6.8	Logical and Physical Access Controls	Security								Enter In scope?
CC7.1	System Operations	Security								Enter In scope?
CC7.2	System Operations	Security								Enter In scope?
CC7.3	System Operations	Security								Enter In scope?
CC7.4	System Operations	Security								Enter In scope?
CC7.5	System Operations	Security								Enter In scope?
CC8.1	Change Management	Security								Enter In scope?
CC9.1	Risk Mitigation	Security								Enter In scope?
CC9.2	Risk Mitigation	Security								Enter In scope?
A1.1	Additional Criteria for Availability	Availability								Enter In scope?
A1.2	Additional Criteria for Availability	Availability								Enter In scope?
A1.3	Additional Criteria for Availability	Availability								Enter In scope?
C1.1	Additional Criteria for Confidentiality	Confidentiality								Enter In scope?
C1.2	Additional Criteria for Confidentiality	Confidentiality								Enter In scope?
PI1.1	Additional Criteria for Processing Integrity (Over the Provision of Services or the Production, Manufacturing, or Distribution of Goods)	Processing Integrity								Enter In scope?
PI1.2	Additional Criteria for Processing Integrity (Over the Provision of Services or the Production, Manufacturing, or Distribution of Goods)	Processing Integrity								Enter In scope?
PI1.3	Additional Criteria for Processing Integrity (Over the Provision of Services or the Production, Manufacturing, or Distribution of Goods)	Processing Integrity								Enter In scope?
PI1.4	Additional Criteria for Processing Integrity (Over the Provision of Services or the Production, Manufacturing, or Distribution of Goods)	Processing Integrity								Enter In scope?
PI1.5	Additional Criteria for Processing Integrity (Over the Provision of Services or the Production, Manufacturing, or Distribution of Goods)	Processing Integrity								Enter In scope?
P1.1	Privacy Criteria Related to Notice and Communication of Objectives Related to Privacy	Privacy								Enter In scope?
P2.1	Privacy Criteria Related to Choice and Consent	Privacy								Enter In scope?
P3.1	Privacy Criteria Related to Collection	Privacy								Enter In scope?
P3.2	Privacy Criteria Related to Collection	Privacy								Enter In scope?
P4.1	Privacy Criteria Related to Use, Retention, and Disposal	Privacy								Enter In scope?
P4.2	Privacy Criteria Related to Use, Retention, and Disposal	Privacy								Enter In scope?
P4.3	Privacy Criteria Related to Use, Retention, and Disposal	Privacy								Enter In scope?
P5.1	Privacy Criteria Related to Access	Privacy								Enter In scope?
P5.2	Privacy Criteria Related to Access	Privacy								Enter In scope?
P6.1	Privacy Criteria Related to Disclosure and Notification	Privacy								Enter In scope?
P6.2	Privacy Criteria Related to Disclosure and Notification	Privacy								Enter In scope?
P6.3	Privacy Criteria Related to Disclosure and Notification	Privacy								Enter In scope?
P6.4	Privacy Criteria Related to Disclosure and Notification	Privacy								Enter In scope?
P6.5	Privacy Criteria Related to Disclosure and Notification	Privacy								Enter In scope?
P6.6	Privacy Criteria Related to Disclosure and Notification	Privacy								Enter In scope?
P6.7	Privacy Criteria Related to Disclosure and Notification	Privacy								Enter In scope?
P7.1	Privacy Criteria Related to Quality	Privacy								Enter In scope?
P8.1	Privacy Criteria Related to Monitoring and Enforcement	Privacy								Enter In scope?

Example

EXAMPLE: how ten rows are filled in

Acme Corp (EXAMPLE) is invented, and so is every control, owner, evidence and reason below. Pairing a control with a criterion is the example organisation's own choice. It says nothing about whether the control addresses the criterion, it is not a mapping, and it is not proposed for your register. Delete this sheet before you rely on the workbook.

How the example set the Categories sheet

Category	In scope?	Reason
Security	Yes	In scope by default (SR-03).
Availability	Yes	A customer requires it (SQ-06).
Confidentiality	Yes	Written commitments on retention and deletion (SQ-07).
Processing Integrity	No	No customer or written commitment needs it (SQ-08).
Privacy	No	Not reported on in this report (SQ-09).

Ten rows of the register

Label	Criterion	In scope?	Reason	Your control or controls	Control owner	Evidence	Status	Notes	What this row shows	Row check (calc)
EXAMPLE	CC1.1	Yes		EX-01 Code of conduct read and acknowledged at hire and each year	HR lead	Dated acknowledgements in the HR system, one per person per year	Operating	Every starter since 1 July has one.	A full row. Control, owner, evidence and status are written, so nothing is missing.	Nothing missing
EXAMPLE	CC3.2	Yes		EX-02 Risk assessment of the service, reviewed once a year	Head of Information Security	Risk register with review dates and decisions (P05-A05)	In place	First review in the period is booked for month 2.	In place means designed and running but not yet run for long. The note says when the first occurrence falls.	Nothing missing
EXAMPLE	CC6.1	Yes		EX-03 Single sign-on with multi-factor authentication for the production console; EX-04 Quarterly review of production access	Head of Engineering	Identity provider settings export; review workbook with approvals (P07-A06)	Operating	Write each control ID wherever it applies.	Two controls in one row. A control may also appear against several criteria. The pairing is your own judgement.	Nothing missing
EXAMPLE	CC6.5	Not relevant	Acme owns no physical devices or media that hold customer data. The hosting provider owns and runs all of them.					Hosting provider carved out (SR-06): say so in the system description (DC-7) and ask the CPA firm whether this criterion is shown as met by the provider's controls or as not relevant.	A reason is a fact about the system (DC-8). Where a carved-out provider alone operates the controls, the description says so (DC-7), and the CPA firm decides how the criterion is shown.	Nothing missing
EXAMPLE	CC7.3	Yes		EX-05 Incident log and a review after each incident		Incident log and review notes (P09-A03)	Planned	Owner to be named this week.	A gap left visible. No owner is named, so Row check says Owner needed and the Summary counts one item with no owner.	Owner needed
EXAMPLE	CC8.1	Yes		EX-06 Every release is peer reviewed and passes automated tests before it ships	Head of Engineering	Pull request and test records in source control, one set per release	Operating	Releases are events: every release in the period is kept.	An event control. The Control Owner & Evidence Plan (P32-A05) counts it as events.	Nothing missing
EXAMPLE	CC9.2	Yes		EX-07 Yearly review of the hosting provider's SOC 2 report (P06-A03)	Head of Information Security	Review note and the list of the report's exceptions	Planned	The provider's controls are assumed, not ours. Name them in the system description (P32-A03).	Where a provider is carved out, Notes records the controls you assume it operates.	Nothing missing
EXAMPLE	A1.2	Yes		EX-08 Daily backups; EX-09 Restore test twice a year	Head of Engineering	Backup job logs; restore test record (P23-A06)	In place	First restore test of the period not yet run.	A criterion of a category set to Yes on the Categories sheet.	Nothing missing
EXAMPLE	C1.2	Yes		EX-10 Customer data deleted within the contract time after a request	Head of Engineering	Deletion ticket, deletion job log and confirmation, one per request	Not started	No request yet in the period. Ask the CPA firm how an empty population is handled.	Not started is a status, not a failure. Say what is missing and what you will ask.	Nothing missing
EXAMPLE	PI1.1	No	Processing Integrity is not in scope for this report. Acme makes no written commitment about the accuracy or completeness of customers' processing (scoping answer SQ-08: No).					Category set to No on the Categories sheet.	A No needs a reason. This one names the scoping answer so a reader can trace it.	Nothing missing

What the Summary would count if these ten rows were the whole register

Count		Number
Marked Yes		8
Marked No		1
Marked Not relevant		1
Marked Yes with no owner		1
Marked Yes with no evidence		0
Marked Yes and Operating		3

These are counts of rows filled in. They are not a score.

Summary

Summary

Counts by category and by status, worked out from the Register. A count is work left or work done in your own register. It is not a score.

The headline counts

Count	Number
Criteria in scope (marked Yes)	0
Items with no owner named	0
Items with no evidence named	0
Items at the status Operating	0
Criteria with no answer to In scope? yet	61

Answers to In scope?, by category

Category	Criteria in the register	No answer yet
Security	33	33
Availability	3	3
Confidentiality	2	2
Processing Integrity	5	5
Privacy	18	18
All categories	61	61

Status of the criteria marked Yes, by category

Category	Marked Yes	Not started	Planned	In place	Operating	No status yet
Security	0	0	0	0	0	0
Availability	0	0	0	0	0	0
Confidentiality	0	0	0	0	0	0
Processing Integrity	0	0	0	0	0	0
Privacy	0	0	0	0	0	0
All categories	0	0	0	0	0	0

What is missing from the criteria marked Yes, by category

Category	Marked Yes	No control named	No owner named	No evidence named	No status yet
Security	0	0	0	0	0
Availability	0	0	0	0	0
Confidentiality	0	0	0	0	0
Processing Integrity	0	0	0	0	0
Privacy	0	0	0	0	0
All categories	0	0	0	0	0

Counts only.

Checks

Checks

Nine checks on the Register as typed. Each says Clear, Action needed or Nothing to check. Where nothing is marked Yes yet, a check shows Action needed, because Security is in scope by default.

The checks

Check	What it looks at	Result	Of	Status (calc)
CK-01	Every category has an answer on the Categories sheet. Security is Yes by default (SR-03).	1	5	Action needed
CK-02	Every criterion in a category set to No is marked No or Not relevant.	0	0	Nothing to check
CK-03	Every criterion has an answer to In scope?.	0	61	Action needed
CK-04	Every No or Not relevant has a reason (DC-8). A [[placeholder]] does not count.	0	0	Nothing to check
CK-05	Every Yes names a control of yours. A [[placeholder]] does not count.	0	0	Action needed
CK-06	Every Yes has a control owner named. A [[placeholder]] does not count.	0	0	Action needed
CK-07	Every Yes names the evidence its controls leave. A [[placeholder]] does not count.	0	0	Action needed
CK-08	Every Yes has a status.	0	0	Action needed
CK-09	Every Operating row also has a control, an owner and evidence named.	0	0	Nothing to check

Needing action

checks

The number of checks that need action is a count of work left. It is not a score.

Lists

ListInScope	ListCategory	ListStatus
Yes	Yes	Not started
No	No	Planned
Not relevant		In place

Operating

Definitions

Definitions

Term	Meaning in this workbook
Trust Services Criteria	The AICPA's criteria for a system, 61 in five categories: 33 Security, 3 Availability, 2 Confidentiality, 5 Processing Integrity, 18 Privacy. Their statements are in the Library. This workbook gives number and series title only.
Criterion	One numbered criterion, such as CC6.1. The number says its series: CC is the common criteria of Security, A is Availability, C is Confidentiality, PI is Processing Integrity and P is Privacy.
Category	One of the five groups of criteria. A report covers Security and any of the others you choose.
In scope?	Yes, No or Not relevant. No means the category or the criterion is out of scope for a stated reason. Not relevant means the criterion does not apply to the system, for a stated reason.
Reason	A fact about the system that explains a No or a Not relevant. A preference or a cost is not a reason. The CPA firm decides whether it stands. DC-8 is this pack's own label for a description topic of the AICPA's DC section 200. The AICPA text was read on 20 October 2026, and the CPA firm confirms the wording.
Control	Something done routinely to keep a risk in check: who does what, how often, and the record it leaves. Yours come from your control inventory.
Control owner	The one person who performs or supervises the control and answers the CPA firm's requests for its evidence.
Evidence	The record a control leaves, and the system that holds it. It is dated, tied to a person or system, and can be retrieved without rebuilding it.
Not started	Nothing is in place for this item.
Planned	It is planned, owned and dated, but not yet in place.
In place	It is designed and running, but has not yet run for the months SR-10 asks for, or left enough records to sample.
Operating	It runs as written, an owner performs it, and the records exist for a sample to be taken. For a first Type 2 period it has run with records for at least 3 months (a house default, SR-10).
Row check	A calculated column. It names the first thing missing from a row, or says Nothing missing. It does not check that a control is suitable.
CPA firm	The licensed firm of certified public accountants that examines management's description and its controls and issues the report. Also called the auditor.
SOC 2 report	A SOC 2 report is an attestation by a licensed CPA firm, not a certificate. Nobody is “SOC 2 certified”, and no document in this pack says that you are or will be.
RG-nn, CK-nn	RG-nn are the register's columns and CK-nn its checks. SR-nn are rules of the pack's Guide. DC-n is a description topic. P20-A03 and similar name documents of other packs.
EXAMPLE	A worked example: Acme Corp (EXAMPLE). Every name and value is made up. Delete before use.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 5.36 — Compliance with policies, rules and standards for information security	Register sheet: the organisation's own record of the controls it has written against each criterion, kept for review
NIST CSF 2.0	GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed”	Categories and Register sheets: a customer's request for a report is recorded as an obligation, with the categories chosen and the controls written
AICPA, SOC 2	Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022): five categories. Security is the category whose criteria, CC1 to CC9, are the “common criteria”: they apply to every report, and a complete set of criteria is the common criteria plus those of each other category chosen. (CC2 is titled Information and Communication in the 2022 edition; earlier editions print Communication and Information.) The criteria number 61: 33 Security, 3 Availability, 2 Confidentiality, 5 Processing Integrity and 18 Privacy. Cited by number and series title only; the statements are in the Library	Register sheet: the 61 criteria by number and series title. Categories sheet: the five categories
AICPA, SOC 2	SOC 2 CC1.1, Control Environment	Register sheet, row CC1.1: listed so that you can write your own control, owner and evidence against it
AICPA, SOC 2	SOC 2 CC3.2, Risk Assessment	Register sheet, row CC3.2: listed for the same purpose
AICPA, SOC 2	SOC 2 CC6.1, Logical and Physical Access Controls	Register sheet, row CC6.1: listed for the same purpose
AICPA, SOC 2	SOC 2 CC7.3, System Operations	Register sheet, row CC7.3: listed for the same purpose, and an example row
AICPA, SOC 2	SOC 2 CC9.2, Risk Mitigation	Register sheet, row CC9.2: listed for the same purpose, and an example row

Editions referenced: AICPA Trust Services Criteria (TSP section 100, 2017, with revised points of focus, 2022), by number and series title only; the AICPA description criteria (DC section 200, 2018, with revised implementation guidance, 2022), by topic only; ISO/IEC 27001:2022 and NIST CSF 2.0, by number and title; the Journal of Accountancy and the AICPA & CIMA pages named in the references; as published and read on 18 October 2026

Criteria are cited by number and series title only. The statements of the criteria are in the Library. Citing a criterion does not say that any document, control or practice meets it.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that holding an ISO/IEC 27001 certificate equals, replaces or shortens a SOC 2 examination.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.

This pack does not say which document, record or practice meets a criterion. Each reference says what its source describes and which CISO Times document helps with that work. Using a document does not by itself show that a criterion is met.