The 5 SOC 2 Trust Services Criteria explained: Security (CC1-CC9), Availability, Confidentiality, Processing Integrity, and Privacy. What auditors evaluate.
Mapping TSCs to evidence? Strac Comply auto-maps live system events — cloud config, SaaS audit logs, endpoint posture, DLP events, MCP tool calls — to every Trust Services Criterion. The same Strac platform protecting your data generates the audit evidence. Start at comply.strac.io →
The AICPA's 2017 Trust Services Criteria (TSC 2017, the current version) is the framework auditors use to evaluate a service organization's controls. Five criteria total:
Each TSC contains specific criteria the auditor will probe. Security alone has 9 Common Criteria (CC1-CC9) with ~64 control points. The four optional TSCs add their own criteria on top.
The mandatory backbone of every SOC 2 audit.
CC6 is where most audit time goes. It covers MFA, SSO, RBAC, encryption, DLP, network segmentation, endpoint protection, physical access — basically every meaningful technical control. Two specific sub-criteria deserve attention:
Strac uniquely covers CC6.6 / CC6.7 because Strac DLP ships with Strac Comply as one platform — the data-protection evidence comes from the same product securing the data. For the full controls reference, see SOC 2 controls.
Optional. Covers system uptime, disaster recovery, business continuity.
Common evidence:
When to include Availability: customers whose business depends on your uptime (financial services, healthcare, real-time systems). Skip if you're an early-stage SaaS where customers don't yet ask about availability formally.
Optional. Covers protection of confidential information — NDAs, contracts, intellectual property, proprietary data.
Common evidence:
When to include Confidentiality: B2B vendors handling customer IP, M&A diligence rooms, legal services, professional services with confidential client work.
Confidentiality overlaps heavily with the data-protection sub-criteria under Security (CC6.6, CC6.7). Strac\'s DLP product covers both with one set of policies.
Optional. Covers system processing accuracy, completeness, timeliness, validity, authorization.
Common evidence:
When to include Processing Integrity: payment processors, financial systems, billing platforms, anywhere "incorrect output" is a business risk worth attesting against.
Optional. Covers personal information collection, use, retention, and disclosure. The most policy-heavy of the optional TSCs.
Common evidence:
When to include Privacy: consumer-data businesses, GDPR / CCPA-exposed orgs that want one report covering compliance with both. Privacy adds 18 control points and significant policy documentation.
Privacy and the broader GDPR / CCPA frameworks overlap. Strac Comply maps the same Privacy evidence to GDPR Articles 5 / 25 / 30 / 32 and CCPA simultaneously.
A practical decision matrix:
You can always add TSCs in later years. The Security-only first audit is a strong starting point; you scope up as customer demand and regulatory exposure grow.
Strac Comply is the AI-native compliance automation platform built for security-led teams. The platform watches your live systems and continuously maps evidence to each criterion under every TSC you've scoped.
Per TSC coverage:
The unique angle: Strac Comply ships with Strac DLP and Strac DSPM as part of the same platform. No separate DLP integration for CC6.6 / CC6.7 / C1.1. One vendor, one bill, full coverage.
Security mandatory? Adding Confidentiality, Availability, or Privacy? Strac Comply maps evidence across every Trust Services Criterion automatically — and uniquely covers the data-protection criteria with the Strac DLP product directly.
Start at comply.strac.io →No. Only Security is mandatory. The other four (Availability, Confidentiality, Processing Integrity, Privacy) are optional. You include them based on what your customers and regulators expect.
TSC is the umbrella for all five criteria. Common Criteria (CC1-CC9) is specifically the Security TSC, organized into 9 categories. The optional TSCs (A, C, PI, P) have their own criteria letter codes.
Within Security (CC1-CC9), CC6 (Logical and Physical Access Controls) has the most controls — 8 control points covering access, MFA, encryption, DLP, network, and endpoint. Of the optional TSCs, Privacy has the most criteria (18 control points).
Yes. Most companies start with Security only and add Confidentiality, Availability, or Privacy in later audits as customer demand grows. Each addition expands audit scope and cost.
The Privacy TSC is principles-based and aligned with OECD privacy principles. GDPR and CCPA are specific legal frameworks. The controls largely overlap — data subject rights, retention, consent — but the legal obligations under GDPR / CCPA are broader. Strac Comply maps Privacy TSC evidence to GDPR Articles and CCPA sections simultaneously.
Heavily. Both cover data protection. Security (CC6.6 / CC6.7) covers data protection broadly; Confidentiality (C1.1 / C1.2) covers "confidential information" specifically (NDAs, contracts, IP). The same DLP and encryption controls satisfy both. Strac\'s DLP product is the evidence source for both.
You have three options: (1) explain that your current report covers Security and the customer accepts it as sufficient, (2) commit to adding the TSC at the next audit cycle, (3) explore a Type 1 audit covering the additional TSC quickly. The right answer depends on the customer's ACV and your audit timeline.
No formal lite version, but SOC 3 is the public-facing summary report based on the same TSCs. SOC 3 is shorter, can be made public, but provides less detail. Most companies do SOC 2 Type 2 for the actual audit and optionally produce a SOC 3 summary for marketing.
The unique angle: Strac Comply ships with Strac DLP and Strac DSPM as part of the same platform. For criteria around data classification, encryption, and DLP — CC6.6, CC6.7, C1.1, C1.2, and parts of P3 / P4 — Strac generates the evidence directly. Other platforms require you to integrate a separate DLP and consolidate evidence into the compliance platform manually.
Yes, partially. AI-specific controls under EU AI Act Article 12 (logging), Article 13 (transparency), Article 14 (human oversight) map to Security TSC criteria CC6.1 (access), CC6.6 (data), CC7.2 (monitoring). ISO 42001 Annex A controls similarly map. Strac Comply\'s mappings cover this cross-framework projection automatically.
The Trust Services Criteria define what auditors actually evaluate. Security is mandatory; the other four are optional and chosen based on business context. Strac Comply covers every criterion automatically and uniquely brings the data-protection evidence in-house with the Strac DLP product.
.avif){kind=icon}
.gif)
.webp)
