What are Trust Services Criteria and which ones should I pick?
What Are Trust Services Criteria?
Trust Services Criteria (TSC) are the five categories the AICPA uses to evaluate your controls during a SOC 2 audit. Security is required for every SOC 2 engagement. The other four are optional and should be added only when your customers or contracts require them.
The Five Criteria Explained
| Criterion | What It Covers | When to Include |
|---|---|---|
| Security (CC) | Protection against unauthorized access, system boundaries, risk management | Always — required for every SOC 2 |
| Availability (A) | System uptime, disaster recovery, performance monitoring | When you have SLA commitments |
| Processing Integrity (PI) | Data processing accuracy and completeness | When you process financial or transactional data |
| Confidentiality (C) | Protection of confidential data (not personal data) | When you handle trade secrets or NDA-covered data |
| Privacy (P) | Collection, use, retention, and disposal of personal information | When you process PII under privacy commitments |
Which Should You Pick for Your First Audit?
Start with Security only. Here is why:
- Security covers 80% of what enterprise buyers evaluate in vendor reviews
- Every additional criterion adds 15–30% more evidence collection work
- Most buyers accept a Security-only report for initial vendor approval
- You can add criteria in your next audit cycle once you know what customers actually request
When to Add More Criteria
Add Availability if you have contractual SLAs (99.9% uptime guarantees). Add Processing Integrity if you handle financial transactions or billing data. Add Confidentiality if your contracts include data classification requirements. Add Privacy only if you process consumer personal data under explicit privacy commitments — most B2B SaaS companies do not need it.
A Common Mistake
Some consultants recommend adding all five criteria to your first audit. This increases scope, cost, and timeline without matching what buyers actually require. Ask your top three enterprise prospects which criteria they need. The answer is almost always just Security.
Screenata helps you scope your SOC 2 audit correctly and generates evidence mapped to the specific Trust Services Criteria you select.