What are the Trust Service Criteria?

The five categories

Each category is a set of criteria, and each criterion comes with points of focus that describe what auditors typically look for. The points of focus are guidance. The criteria are what the auditor reports against.

• Security. Protection against unauthorised access, unauthorised disclosure and damage to systems. Always in scope.
• Availability. Whether the system is available for operation and use as committed, including capacity, backup and recovery.
• Confidentiality. Protection of information designated as confidential, such as customer business data, through to its disposal.
• Processing Integrity. Whether system processing is complete, valid, accurate, timely and authorised.
• Privacy. How personal information is collected, used, retained, disclosed and disposed of, in line with the organisation’s commitments.

The common criteria

Security is made up of the common criteria, so called because they apply whichever other categories are added. The first five groups carry the 17 principles of the COSO 2013 internal control framework. The remaining groups cover areas specific to technology. When you add Availability, Confidentiality, Processing Integrity or Privacy, their criteria are tested on top of the common criteria, never instead of them.

• CC1 to CC5. Control environment, communication and information, risk assessment, monitoring activities and control activities.
• CC6. Logical and physical access controls.
• CC7. System operations, including detecting and responding to incidents.
• CC8. Change management.
• CC9. Risk mitigation, including risk from vendors and business partners.

Choosing which to include

Include a category only when customers expect it or your service depends on it. Availability is common for infrastructure and platform services with uptime commitments. Confidentiality suits companies that hold customers’ sensitive business data. Processing Integrity fits payments, payroll and other services where a calculation error causes real harm. Privacy is chosen less often, and many organisations cover personal data through their GDPR or wider privacy programme instead.

Each category you add means more controls to run and more evidence for the auditor to test, so adding all five to a first report is rarely worth it. Categories can be added to later reports as customers ask for them.

Related terms

SOC 2 Type I

A SOC 2 report on whether controls are suitably designed and in place on a single date. Often the first report a company obtains.

SOC 2 Type II

A SOC 2 report on whether controls operated effectively over an observation period. The report most enterprise buyers eventually ask for.

Control mapping

Linking one control to every framework requirement it satisfies, so the same control and its evidence count towards SOC 2, ISO 27001 and other frameworks at once.

Attestation report

An independent auditor’s written opinion on whether an organisation’s controls are designed, and in a Type II report operating, as described. A SOC 2 report is an attestation, not a certificate.

Control

A specific safeguard or activity that reduces a risk, such as requiring MFA on privileged accounts or reviewing access every quarter. Frameworks are, in large part, lists of controls.