SOC 2 Trust Services Criteria

Security (required)

SOC 2 Security Criteria: Control Implementation

Availability

SOC 2 Availability Criteria

Processing Integrity

SOC 2 Processing Integrity

Confidentiality

SOC 2 Confidentiality Criteria

Privacy

SOC 2 Privacy Criteria

CC1 Control Environment

Control Environment: Tone at the Top

CC2 Communication & Information

Information & Communication

CC3 Risk Assessment

Risk Assessment Process

CC4 Monitoring Activities

Monitoring Activities

CC5 Control Activities

Control Activities

SOC 2 Common Criteria: Universal Requirements

The mandatory CC baseline in every report

SOC 2 Additional Criteria: Optional Categories

When to add Availability/PI/Confidentiality/Privacy

SOC 2 Control Objectives

Defining expected outcomes

SOC 2 Control Design

Creating effective controls (Type I focus)

SOC 2 Operating Effectiveness

Demonstrating consistent performance (Type II)