SOC 2 criteria come in groups. The common criteria CC1 to CC9 form the mandatory Security category, and four optional categories add Availability (A1), Confidentiality (C1), Processing Integrity (PI1) and Privacy (P). Each group asks a simple question, and your job is to show a control and evidence for it.
How is the framework organised?
The AICPA's 2017 Trust Services Criteria, with 2022 points of focus, define five categories. Security uses the common criteria. A report may add any of the other four based on what you promise customers. The criteria describe objectives, not tools, and the points of focus are guidance, not a checklist you must complete. Below, each group is paraphrased with its criteria IDs.
What does each common criteria group ask?
CC1, control environment. Does leadership set a tone and structure for integrity and accountability? Think code of conduct, board or leadership oversight, clear roles, hiring and competence, and accountability for control duties (CC1.1 to CC1.5).
CC2, information and communication. Do you use good information and tell people what they need to know? Internal communication of security responsibilities, and communication with customers and external parties about commitments and issues (CC2.1 to CC2.3).
CC3, risk assessment. Do you know your objectives, the risks to them and how things change? Set objectives, identify and analyse risks, consider fraud, and assess changes that could affect controls (CC3.1 to CC3.4). The deliverable is a living risk assessment.
CC4, monitoring. Do you check that your controls work and fix deficiencies? Ongoing or separate evaluations, and communication of deficiencies to those who can fix them (CC4.1 and CC4.2).
CC5, control activities. Do you turn risks into controls through policies and technology controls? Select and develop control activities, general technology controls and policies that say what is expected and how (CC5.1 to CC5.3).
CC6, logical and physical access. Is access to systems and data limited to people who should have it? Access software and architecture, registering and authorising users before credentials issue, granting, changing and removing access, physical access, secure disposal, protection against outside threats, restricting data movement and encryption, and preventing or detecting unauthorised software (CC6.1 to CC6.8). This is the largest group for engineers.
CC7, system operations. Do you detect and handle problems? Detection and monitoring, anomaly monitoring, evaluating events, responding to incidents and recovering from them (CC7.1 to CC7.5).
CC8, change management. Are changes to systems authorised, tested and approved before they reach production? One criterion, CC8.1, with a lot of weight in software companies.
CC9, risk mitigation. Do you handle business disruption and vendor risk? Risk mitigation activities including insurance or continuity, and managing risks from vendors and partners (CC9.1 and CC9.2).
What do the optional categories add?
Availability, A1.1 to A1.3. Capacity management, environmental protections and backup and recovery infrastructure, and testing recovery plans.
Confidentiality, C1.1 and C1.2. Identify and maintain confidential information, and dispose of it when it is no longer needed.
Processing Integrity, PI1.1 to PI1.5. The system processes data completely, accurately and on time: quality information about processing, controls over inputs, processing and outputs, and storage of data.
Privacy, P1 and onward. Notice, choice and consent, collection, use and retention, access, disclosure, quality and monitoring of personal information. It applies when you handle personal information as part of the service.
How do Type 1 and Type 2 relate?
A Type 1 report describes the design of controls at a point in time, with no opinion on operating effectiveness. A Type 2 report covers a period and includes tests of operating effectiveness. The criteria are the same, and the difference is the evidence over time.
How should a small team use this?
Pick categories by what your customers need, usually Security plus perhaps Availability or Confidentiality. Map each criterion to one or two controls rather than writing a control per bullet. Keep policies short.
What mistakes are common?
- Adding categories because competitors have them.
- Treating points of focus as mandatory checklists.
- Writing controls that cover CC6 but forgetting CC1 to CC5.
- Skipping the risk assessment, which drives control choice.
What to do
- Decide categories based on customer commitments.
- Build a control matrix mapped to criteria IDs.
- Complete the risk assessment first.
- Fill CC6, CC7 and CC8 with technical controls and evidence.
- Add governance, monitoring and vendor controls for the rest.
- Choose Type 1 or Type 2 with your auditor.
Quick check
Which SOC 2 category is mandatory?
Security, which uses the common criteria CC1 to CC9.
Are points of focus a checklist?
No. They are guidance on important characteristics of a criterion, and you decide which apply to your controls.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence for criteria such as CC6, CC7 and CC8 is collected from connected systems and code instead of by screenshot, and monitoring continues between audits, which gives the team time for other work. Technical proof comes from your real code and dependencies through scans, SBOMs and reachability. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. An independent CPA firm issues the SOC 2 report. Safeguard helps you prepare and keep evidence ready.
Open the framework mapping demo
Sources
- AICPA 2017 Trust Services Criteria with 2022 points of focus, criteria CC1 to CC9, A1, C1, PI1 and P, read from the AICPA publication
Last reviewed: 18 October 2026.
