FAQ: How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system, commitments, and report users' needs. For example, contractual uptime commitments deserve a specific conversation about availability. Handling personal information deserves a careful privacy discussion, not an automatic assumption that every report must include every category. Keep a short rationale for the selection and confirm it with important customers before signing. Adding categories simply to make a report look more complete can create work without answering a real reporting need.

Related: SOC 2 trust services categories.

Further reading: AICPA SOC 2 reporting guide overview.

Additional FAQs

What should an AI inventory include?

Start with the AI services people actually use, including features inside existing software. For each use case, record the owner, provider, purpose, users, data involved, connected systems, and whether the

Does a green automated check prove the control is working?

Not by itself. It provides evidence only about what the check measures, and only if its data and logic are reliable. Ask which systems are included, when the check last

Do changes to compliance scripts and automation rules need review?

Treat changes according to their risk and the role the automation plays. A script that prepares an audit population or a rule that disables accounts can materially affect records or

Can different vendors still leave us dependent on the same provider?

Yes. Two vendors may use the same cloud service, identity provider, or other essential supplier. One disruption could affect both. Compare dependencies across important services, including your backup option. Look

Are Third Party Vendor reviews required for SOC 1 and SOC 2?

Review outsourced services that can affect the in-scope system or controls. The extent of review should reflect the service and its risks. Where a vendor supplies an assurance report, assess

Should we ask vendors how they manage their own third parties?

Yes, especially when the service supports important operations or gives others access to sensitive information. Ask how the vendor: For an important dependency, request a recent review example and its

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide