The AICPA's Trust Services Criteria are still the 2017 criteria with the 2022 revised points of focus, and the AICPA's SOC 2 description criteria download is listed with a 9 July 2025 date. On 14 October 2026 a CPA firm's updated explainer repeated the point most first-timers need: "Security alone is a perfectly legitimate SOC 2." Choosing categories and a system boundary is the first real decision in a SOC 2 project, and it is where small companies either overbuy or get a report their customer rejects.
What's affected
Anyone scoping a first SOC 2 examination. Two separate choices are involved, and they are often confused.
Which categories. The criteria are organized into five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is built from the common criteria, which are the CC1 to CC9 series (control environment, communication, risk assessment, monitoring, control activities, access, system operations, change management and risk mitigation). The AICPA text says the common criteria "are suitable for evaluating the effectiveness of controls to achieve an entity's system objectives related to security; no additional control activity criteria are needed." The other four categories add their own series on top.
Which system. The criteria can be applied across an entire entity, at a subsidiary, division or operating unit, within a function, or for a particular type of information. For a software company that usually means one production service and its supporting infrastructure, people and procedures.
| Category | What it covers | Add it when |
|---|---|---|
| Security | Protection against unauthorized access, disclosure and damage to systems | Always. It is required. |
| Availability | Systems are available for operation and use to meet objectives | Your contracts or customers depend on uptime, backups and recovery |
| Processing Integrity | Processing is complete, valid, accurate, timely and authorized | The service transforms or calculates data customers rely on being correct |
| Confidentiality | Information designated confidential is protected | You hold customer data under confidentiality commitments |
| Privacy | Personal information is collected, used, retained, disclosed and disposed of to meet objectives | You collect personal information directly from data subjects |
Two details from the AICPA text save arguments later. First, availability "does not, in itself, set a minimum acceptable performance level," so choosing it does not commit you to a particular uptime number. Second, confidentiality is not privacy: privacy applies only to personal information, while confidentiality covers other sensitive material such as trade secrets.
How to check if you're exposed
Work from the customer's request outward.
- Read the security questionnaire or contract clause that triggered the request. Does it name categories? Many ask only for "SOC 2 Type 2" and mean Security.
- List your commitments. Do you promise uptime or recovery times in contracts? That points to Availability. Do contracts label customer information confidential? That points to Confidentiality.
- Draw the system boundary on one page: the product, the cloud accounts it runs in, the code repositories and pipelines, the identity provider, and the support tools that touch customer data.
- Mark every vendor on that page. Anything that processes customer data for you will appear in the report as a subservice organization, which is covered in a separate post on vendor management.
- Ask the auditor whether any criterion would be not applicable. The AICPA text says all criteria for an included category are "usually addressed," with limited exceptions. Its example is criterion P3.1, which does not apply to an organization that does not collect personal information directly from data subjects.
What to do now
- Start with Security unless a signed contract requires more. Each added category adds criteria that must be tested across the whole period.
- Add Availability only if you can show backups and recovery testing. Criterion A1.3 asks that the entity "tests recovery plan procedures supporting system recovery." If you have never restored from backup, you will fail that test in front of the auditor.
- Add Confidentiality only if you can say where confidential data lives and how it is disposed of. Criteria C1.1 and C1.2 cover identifying and maintaining confidential information, and disposing of it.
- Write the system description scope sentence once, and get it reviewed by whoever signs contracts. It should match what sales promises.
- Plan to add categories in a later period. A first Type 2 on Security that is followed by a second one adding Availability is a normal sequence.
How to avoid this trap
- Do not include a category to look thorough. Every extra category is more evidence and more chances for an exception.
- Do not exclude the system your biggest customer actually uses. A CPA firm warns that clients "may not accept a report if it's not properly scoped," so confirm the customer's production service is the one in scope.
- Do not draw the boundary around your cloud provider and forget your own pipeline, identity provider and support tooling. The change management criterion (CC8.1) covers changes to "infrastructure, data, software, and procedures."
- Do not treat the AICPA points of focus as a checklist. The text says the points of focus may be customized and that using the criteria "does not require an assessment of whether each point of focus is addressed."
Why it matters
The auditor tests what your system description says. Scope that is too wide creates work and exceptions. Scope that is too narrow creates a report your customer cannot use, and you will redo it. The February 2026 Journal of Accountancy article on quick-turn SOC reports advises customers to ask about scope and to check whether a report reflects the system's specific risks, so expect your buyer to read the scope section first.
Scope is also a business decision, not only a technical one. Whoever owns revenue should confirm the categories before the engagement letter is signed.
Try it yourself
Take the production service named in your largest customer contract. Write down its cloud accounts, its repositories, its identity provider and its three most important vendors. That list is your first draft boundary. Then mark each Security common criterion (CC1 to CC9) with the person who would produce the evidence.
Click through it at your own pace, or open it full screen.
Quick check
Which Trust Services category is required in every SOC 2 report?
Security. It is the category built from the common criteria. Availability, Processing Integrity, Confidentiality and Privacy are optional.
Does choosing Availability commit you to a specific uptime percentage?
No. The AICPA text says the availability objective does not, in itself, set a minimum acceptable performance level. It does require controls such as capacity management, backups and recovery testing.
What is the difference between Confidentiality and Privacy?
Privacy applies only to personal information. Confidentiality applies to information designated confidential, which can include trade secrets and other non-personal material.
Sources
- AICPA: 2017 Trust Services Criteria with revised points of focus (2022)
- AICPA: 2018 SOC 2 Description Criteria with revised implementation guidance (2022)
- Linford and Company: What Is SOC 2? (updated 13 October 2026)
- Linford and Company: SOC audit failure, common mistakes
- Journal of Accountancy: Promises of fast and easy threaten SOC credibility (1 February 2026)
