FAQ: Are the proposed 2027 SOC 2 criteria final requirements?

No. As of October 30, 2026, the AICPA's proposed 2027 Trust Services Criteria and Description Criteria are exposure drafts, not final requirements. The announced comment deadline is January 15, 2027. The AICPA says that, if approved, the proposed Trust Services Criteria would apply to engagements beginning on or after December 31, 2027, with early adoption permitted. Confirm the criteria applicable to your engagement with the auditor rather than treating the proposal as already effective. Keep current preparation moving, track the final publication, and avoid rewriting control identifiers solely because a draft contains a different structure.

Related: SOC 2 trust services categories.

Further reading: AICPA proposed 2027 criteria announcement; AICPA 2027 criteria exposure drafts.

Additional FAQs

What should an AI inventory include?

Start with the AI services people actually use, including features inside existing software. For each use case, record the owner, provider, purpose, users, data involved, connected systems, and whether the

What is the difference between a SOC 2 auditor, advisor, and software provider?

The auditor performs the independent examination and issues the report. An advisor can help you define scope, identify gaps, and improve processes. Software can organize work and collect certain evidence.

How long does a SOC 1 take to complete?

This depends on how prepared and how many resources an Organization has to dedicate to the project. The first time through, usually a readiness assessment would be performed, and then

What is SSAE 18 (formerly SSAE 16)?

SSAE No. 18, Attestation Standards: Clarification and Recodification, is an AICPA standard that clarified and recodified the attestation standards. It superseded SSAE No. 16 and other earlier standards, with specified

What are the costs of SOC 2?

There are a lot of factors that go into responding to this question. There are audit, consulting, software, internal resources, and other factors to consider which can easily grow from

SOC1 vs SOC2: Differences?

At a high-level, SOC1 is about financial controls, while SOC2 focuses on information security controls. They serve different end-user customers and stakeholders.

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide