Going through a SOC 2 compliance journey can feel like an insurmountable task on the surface. That’s why we love to break it down into manageable steps and components that are easier to understand. 

Today, we’re focusing on the five trust services criteria (TSC) for SOC 2. These are five criteria that can be applied to your SOC 2 audit, and include:

• Security 
• Availability
• Confidentiality 
• Processing integrity 
• Privacy

The first, security, is a required criteria for any SOC 2 audit. This is why it’s also called the common criteria. The rest are optional — it’s up to you whether you want to audit those capabilities or not. 

Below, we dive into each of the five criteria with a bit of a definition and an explanation behind why you might want to audit it.

Security

The security criteria evaluate a company’s ability to protect data throughout its lifecycle — when it’s at rest, in motion, and in use. As such, the audit for this criteria will focus on controls that protect against unauthorized access, data leakage, and misuse of data. The controls in place should include a variety of risk-mitigating solutions, including endpoint protection, network monitoring, identity and access management, and more. 

To prepare for an audit of your security criteria, you’ll need to spend time reviewing all the requirements, identifying gaps, and implementing controls as needed before they’re reviewed. 

When to include it: As mentioned above, the security criteria is required for all SOC 2 audits.

Availability

The availability criteria evaluate a company’s effectiveness in terms of their technology’s uptime and performance. While the criteria don’t establish a baseline for performance, they do determine whether systems include controls and stopgaps to uphold system operation. These controls can include the likes of performance monitoring, regular data backups, and robust data recovery plans. 

When to include it: If you’re operating in a space where there are concerns around downtime or customers that rely on service level agreements (SLAs). Ultimately, including the availability criteria helps build trust with customers that want consistent performance and uptime.

Confidentiality

When it comes to confidentiality, the criteria require companies to showcase their ability to safeguard the confidential information of their internal and external users at all stages. That includes data collection, processing, and disposal. Confidential information can include personal information, trade secrets, and intellectual property. Often, confidentiality controls are defined by industry regulations and laws, as well as any contracts with customers and partners. The controls can cover things such as encryption and identity and access management. 

When to include it: If you regularly store sensitive information that’s protected under non-disclosure agreements, or if you have requirements to delete customer information when it’s no longer needed. 

Processing integrity

The processing integrity criteria assess a company’s ability to process data in a predictable manner, without any accidental or unexplained errors. They determine whether the information that’s produced or managed by your systems are both accurate and reliable. 

Ultimately, the processing integrity criteria speak to a technology’s reliability, which is an important metric in multiple industries.

When to use it: If your customers use your systems and technology to execute critical tasks such as financial or data processing. 

Privacy

Similar to the confidentiality criteria, the privacy criteria focus on storing confidential information. The difference is that they focus specifically on personally identifiable information — especially the data collected from customers. The controls under privacy include reviews of customer communication, consent gathering, and the collection of personal information. They also should help verify that the right parties have access to that information, and that there are specific guidelines around what can be done with that information. These controls can include privacy policies and consent management systems.

When to use it: If your customers use your systems to store personally identifiable information including social security numbers, financial information, birthdays, or healthcare information.

Which criteria should I include in my audit? 

It depends. 

While the security criteria is a must have for every SOC 2 audit, it’s called the common criteria for a reason, the other four are optional. Whether or not you include them will depend on the type of product or service you offer, and where you want to inspire confidence for your customers. For example, if your company provides cloud servers or storage, you might consider doing an audit of your system’s availability so as to show that you abide by best practices. This will help you stand out against your competitors. 

‍Need help choosing the right criteria for your SOC 2 audit? We can help. Get in touch to learn how.