FAQ: How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system, commitments, and report users' needs. For example, contractual uptime commitments deserve a specific conversation about availability. Handling personal information deserves a careful privacy discussion, not an automatic assumption that every report must include every category. Keep a short rationale for the selection and confirm it with important customers before signing. Adding categories simply to make a report look more complete can create work without answering a real reporting need.

Related: SOC 2 trust services categories.

Further reading: AICPA SOC 2 reporting guide overview.

Additional FAQs

What should we check before changing compliance platforms?

Export your evidence, control mapping, review history, issues, and ownership records before ending the old contract. Check whether the export includes attachments and timestamps, not just a summary spreadsheet. Plan

How should AI-related mistakes fit into incident response?

Use the existing reporting route, but make sure it recognizes AI-specific problems such as unintended disclosure, unsupported customer-facing statements, or an agent taking an unauthorized action. Record the use case,

What is a SOC 2?

SOC 2 is an independent CPA examination of a service organization’s described system and controls against the applicable Trust Services Criteria. SOC stands for System and Organization Controls. A Type

Are the proposed 2027 SOC 2 criteria final requirements?

No. As of October 30, 2026, the AICPA's proposed 2027 Trust Services Criteria and Description Criteria are exposure drafts, not final requirements. The announced comment deadline is January 15, 2027.

We have a SOC 2. How much effort is GDPR?

Estimate the extra effort by mapping the personal-data activities and GDPR obligations that apply, then comparing them with your existing controls and evidence. Sort the gaps into three groups: already

How do we know when spreadsheets are no longer enough?

Look for repeated failures in coordination, not just team size. Warning signs include broken evidence links, unclear ownership, conflicting versions, missed reviews, and excessive time reconciling records. Measure where the

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide