If you’re preparing for a SOC 2 audit, understanding the Trust Services Criteria (TSC) is foundational. These five categories: Security, Availability, Confidentiality, Processing Integrity, and Privacy, define the scope of your compliance and determine what controls your auditors will evaluate. But which ones should you include, and why? Here’s a comprehensive guide.
Trust Services Criteria are the backbone of any SOC 2 examination. Developed by the AICPA, they provide a structured way to assess the design and effectiveness of controls across five categories:
These are not one-size-fits-all. Your selection of TSCs should reflect your service commitments and contractual obligations—not just your tech stack or industry.
The Security category includes all nine Common Criteria (CC) and is mandatory in every SOC 2 report:
This sets the baseline for access control, incident response, and change management. For many SaaS companies, it’s the only category needed for initial audits.
Relevant Truvo article: SOC 2 / ISO 27001 Frequently Asked Questions
Availability includes three additional criteria beyond Security, covering:
Include this category if you’ve made SLAs or public guarantees around uptime. Cloud-native features often make it easier to support. You’ll typically implement 8–10 controls here.
Confidentiality includes two criteria focused on secure handling of proprietary or sensitive data. It becomes essential when you:
Related content: Unpacking SOC 2: What Are CSOCs and Why Does Their Inclusion in an Audit Matter?
With five criteria, this category ensures that data processing is complete, valid, accurate, timely, and authorized. Include it if your product processes or generates data your customers rely on:
Controls must be tailored to application logic and data flows.
Privacy covers eight criteria and applies mainly to data controllers who interact directly with end users and PII. Include it if you:
If you’re just processing data on behalf of another party, Confidentiality may be enough.
| Commitment | TSC Required |
|---|---|
| “99.9% uptime SLA” | Availability |
| “Delete customer data within 30 days” | Confidentiality |
| “Accurate billing statements” | Processing Integrity |
| “GDPR-compliant privacy notice” | Privacy |
| Business Type | Common TSCs |
|---|---|
| B2B SaaS (early stage) | Security only |
| FinTech platforms | Security + Availability + Confidentiality |
| Payroll/HR Tech | Security + Processing Integrity + Confidentiality |
| AdTech collecting PII | Security + Privacy + Confidentiality |
Understanding these criteria is the first step, but the key to scaling your compliance and saving countless engineering hours is automation. Manually collecting evidence for hundreds of controls across these five criteria is time-consuming and unsustainable.
Modern GRC platforms are designed to solve this exact problem. To learn exactly how tools like Drata and Vanta connect to your cloud environment to provide continuous monitoring and evidence collection, see our complete guide.
Read Now: The Ultimate Guide to SOC 2 Automation for SaaS Companies
At Truvo, we specialize in managed SOC 2 compliance for cloud-native startups and scaling companies. Our services include:
Whether you’re getting started or expanding your audit scope, we simplify your journey. Contact us today to get started.
Schedule a free GRC consultation to explore how Truvo can help you achieve SOC2 audit-readiness and modernize your GRC program, without slowing down innovation.