SOC 2 is a framework used to examine controls at service organizations that are relevant to security and other aspects of information and system management. The framework is based on the Trust Services Criteria established by the American Institute of Certified Public Accountants. Depending on the scope of an examination, an organization may be evaluated against one or more of five criteria. These criteria provide a structured way to understand how an organization addresses risks involving systems, information, and service operations.
The five Trust Services Criteria provide different perspectives for evaluating organizational controls. Security is the common criterion for SOC 2 examinations, while the remaining criteria may be included depending on the services and risks being considered.
These criteria can overlap in practice. For example, access controls may contribute to security while also supporting confidentiality. Similarly, backup procedures and system monitoring can be relevant to both security and availability.
The criteria help establish the areas that an independent examination may consider when evaluating an organization's controls. They do not prescribe one universal set of technologies or procedures. Instead, organizations generally establish controls that are appropriate for their systems, services, commitments, and identified risks.
Important areas commonly considered include:
A SOC 2 examination can result in a report describing the design and, depending on the type of examination, operating effectiveness of relevant controls. Organizations and their customers can use the report to understand how specified controls were evaluated during the examination period.
Service organizations often manage infrastructure, applications, data, or business processes for customers. As a result, customers may need information about the controls used to protect systems and information. The Trust Services Criteria provide a consistent framework for presenting and evaluating this information.
The relevance of each criterion depends on the nature of the services provided. For example, availability may be particularly important for a hosted application, while confidentiality or privacy may receive greater attention when sensitive information is processed.
Understanding the criteria can also help organizations distinguish between different control objectives. Security addresses unauthorized activity broadly, whereas privacy concerns personal information and how it is handled. Processing integrity, meanwhile, focuses on whether systems perform their intended processing accurately and completely.
SOC 2 Trust Services Criteria therefore provide a structured foundation for assessing controls at service organizations. By covering security, availability, processing integrity, confidentiality, and privacy, they address different dimensions of how systems and information are managed. Their application depends on the services, commitments, and risks within the scope of an examination. Understanding these criteria can help organizations and report users interpret SOC 2 information more effectively and recognize which control areas are relevant to particular services.