SOC 2 Report: Trust Services Criteria and Categories

The categories in a SOC 2 report tell you which areas the examination covers. They are not five levels of certification. A report with more categories is not automatically a better fit for your needs.

What do the five categories mean?

• Security: Protecting information and systems against unauthorized access and damage.
• Availability: Keeping information and systems available for their intended use.
• Processing integrity: Processing the right information correctly and completely. Work must also be timely and authorized.
• Confidentiality: Protecting information designated as confidential, including business secrets.
• Privacy: Handling personal information appropriately throughout its life. This goes beyond keeping it secret.

The common criteria apply across the categories. Availability, processing integrity, confidentiality and privacy have additional criteria. Choose the report scope based on the service and the commitments it needs to support.

The AICPA Trust Services Criteria provide the detailed benchmarks. The definitions above are a plain-language introduction, not a replacement for them.

Criteria and controls are different

A criterion is a benchmark used to evaluate controls. A control is something your organization does to address a risk.

For example, a company needs to limit access to customer files. Its manager approves access for new staff. Its IT team removes access when people leave. Someone checks the remaining permissions.

Those are controls. The approval and removal records help show whether the work happened. Buying an access-management tool does not establish that the process works.

What else does the examination cover?

SOC 2 also examines the presentation of the service organization’s system description. Separate Description Criteria apply to that part of the report.

A Type 1 report addresses control design at a specified date. A Type 2 report also addresses how effectively controls operated over a period. Do not treat a snapshot as evidence of months of operation.

What should you check in a report?

• The service: Does the description cover what you actually use?
• The categories: Do they address the concerns behind your request?
• The dates: Does the report cover the relevant point in time or period?
• The opinion: What conclusion did the auditor reach?
• The results: Which exceptions or limitations matter to your use of the service?

An unmodified opinion does not promise that no control ever failed. Read the results rather than counting exceptions or treating the report as a general safety badge.

Choose scope for a reason

Suppose a customer needs assurance about a hosting service’s uptime commitments. Ask whether the proposed report addresses availability. Adding a different category would not answer that question just because it made the report longer.

For help deciding the scope, see how to choose SOC 2 categories. The category reference provides more detail.

Earlier versions of this article used the older term “Trust Services Principles.” Use the criteria applicable to your engagement rather than relying on that historical wording.

Reviewed November 8, 2026. Original publication date retained.