The five criteria, in one place
SOC 2 has five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is mandatory in every report. The other four are optional and appear only if you deliberately scope them in.
That last sentence carries more weight than it looks. Scope is the single largest driver of what a SOC 2 costs and how long it takes, and it is decided by you, early, often without much thought.
| Criterion | Mandatory | Include it when… |
|---|---|---|
| Security | Yes | Always — there is no SOC 2 without it |
| Availability | No | You have contractual uptime commitments |
| Processing Integrity | No | You process transactions where correctness is the product |
| Confidentiality | No | Customer data carries classification or retention obligations |
| Privacy | No | You process personal data in ways a privacy notice must describe |
Security — the nine Common Criteria
Security is delivered through CC1 to CC9, and it is the bulk of any SOC 2 engagement. It covers governance and the control environment, communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management, and risk mitigation.
Most findings originate in CC6, logical and physical access — and within CC6, multi-factor authentication on production is the most commonly failed control in the entire framework. Each series is broken down in SOC 2 Common Criteria: CC1 through CC9.
A Security-only report is a complete SOC 2 report. It is what most companies issue first and it satisfies the large majority of enterprise security reviews.
Availability
Covers whether the system is available for operation as committed. In practice: capacity monitoring against forecast demand, backups that run on schedule, restores that have actually been tested rather than assumed, a recovery plan with defined RTO and RPO, and environmental monitoring with alerting.
Scope it in when you have uptime commitments in customer contracts and a customer has asked you to evidence them. Skip it when nobody has asked — an SLA in your terms is not, by itself, a reason to add a criterion to an audit.
The control most often missing here is the tested restore. Companies back up diligently and discover during fieldwork that nobody has ever restored from one.
Processing Integrity
Covers whether processing is complete, valid, accurate, timely and authorised. Input validation before processing, error detection and correction, output reconciliation against expected results, and monitoring of data quality and completeness.
Scope it in when correctness of processing is the product — payments, billing, payroll, clearing, anything where a wrong number is the failure mode. Skip it when your product stores and presents data rather than transforming it, which is most SaaS.
This is the least-scoped of the five, and appropriately so. It is genuinely demanding, and irrelevant to a lot of products that add it anyway.
Confidentiality
Covers information designated confidential being protected as committed. Classification of confidential data, defined retention periods per classification, evidenced secure disposal, and confidentiality obligations flowing into vendor and employee agreements.
Scope it in when customer contracts impose classification, retention or destruction obligations you need to evidence. Skip it when your security controls already cover the data and no contract distinguishes a confidential tier.
The trap here is disposal. Classification and retention are usually documented; proving that data was actually destroyed at end of retention frequently is not.
Privacy
Covers personal information being collected, used, retained, disclosed and disposed of in line with your privacy notice. A notice describing all of that, consent captured where required and revocable, a defined process and SLA for data subject access and deletion requests, and agreements governing personal data shared with third parties.
Scope it in when you process personal data directly and a customer has asked for privacy assurance specifically. Skip it when you are a processor acting on customer instruction — that is usually addressed through your DPA rather than through a Trust Services Criterion.
Privacy is the most commonly over-scoped criterion. Teams add it because privacy feels important, then discover that the data subject request SLA is a real operational commitment they now have to evidence monthly.
What each added criterion actually costs you
| Adding… | Extra controls | Extra evidence burden | Effect on timeline |
|---|---|---|---|
| Availability | Moderate | Restore tests, capacity reviews, incident records | Small |
| Processing Integrity | High | Reconciliation samples across the window | Significant |
| Confidentiality | Low to moderate | Classification records, disposal evidence | Small |
| Privacy | High | Consent records, DSAR logs, ongoing SLA proof | Significant |
None of this is an argument for a thin report. It is an argument for a report that matches what someone asked for. Scope is decided per report, so a Security-only Type 2 now and Availability added in the next period is a perfectly normal path — starting narrow does not lock you in.
How to actually decide
Read the request. If a customer triggered this, their security questionnaire or contract usually names what they need. Answer that question and no other.
Ask what breaks their trust. Availability matters to someone whose business stops when yours does. Processing Integrity matters when your output is a number they act on. The criterion should map to their actual exposure.
Count the evidence, not the controls. A criterion with ten controls that each need monthly evidence is a bigger commitment than one with twenty annual ones.
Decide before the window opens. Adding a criterion mid-window means its evidence does not cover the full period, which produces exceptions you cannot remediate retroactively.
FAQs
What are the five SOC 2 Trust Services Criteria?
Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is mandatory in every SOC 2 report and is delivered through the nine Common Criteria. The other four are optional and appear only if you scope them in.
Which Trust Services Criteria should I include?
Only the ones a customer has actually asked for. Security alone satisfies the large majority of enterprise security reviews. Add Availability if you have contractual uptime commitments, Confidentiality if you handle customer data under classification obligations, and Privacy only if you process personal data in ways a notice must describe.
Is Security the only mandatory criterion?
Yes. Security, sometimes called the Common Criteria, appears in every SOC 2 report. A report covering only Security is a complete and normal SOC 2 report, and it is what most companies issue first.
Does adding criteria make my SOC 2 report stronger?
Not in the way people assume. It makes the report broader, not more credible. Each added criterion brings more controls, more evidence across the observation window, more fieldwork and a longer timeline. A clean Security-only report beats a delayed five-criteria one in almost every procurement conversation.
Can I add criteria to a later SOC 2 report?
Yes. Scope is decided per report, so many companies issue a Security-only Type 2 first and add Availability or Confidentiality in a subsequent period once a customer requires it. Starting narrow does not lock you in.
Where to go next
Scope is one of the first things a readiness assessment settles. For the full picture read SOC 2 compliance, work the control list in the checklist, or see how each criterion is tested in the audit.