Trust Services Criteria
The Trust Services Criteria, also formerly known as the Trust Services Principles, are a set of control criteria used to evaluate, analyze and report on the suitability of the design and operating effectiveness of controls relevant to five sections of an organization’s information and systems.
These five principles are- Security, Availability, Processing Integrity, Confidentiality, or Privacy. These Trust Services Criteria have been established by the Assurance Services Executive Committee (ASEC) that falls under the American Institute of Certified Public Accountants (AICPA).
Every SOC 2 audit structure and report comprises these five Trust Services Criteria depending on their relevance. Both types of SOC 2 reports consist of the Security category. However, the other four categories are optional and may or may not be included by a company according to the needs of their customer and their own distinct business model.
The five categories for trust service criteria have been explained under.
| Category | Description |
| Security | Systems and data within the hold of a company are protected against unauthorized access and unauthorized disclosure. |
| Availability | Information and systems that are available for effective operation and usage. |
| Confidentiality | Confidential information about clients and businesses is protected and secure. |
| Privacy | All personal information is collected, retained, disclosed, used and disposed of in relevance with the pre-stated rules and policies. |
| Processing integrity | Entire system processing is valid, accurate, complete, timely, and authorized. Client data remains correct over the entire course of data processing. |
The trust criteria also mention that the Confidentiality TSC applies to all kinds of sensitive information, whereas the Privacy TSC applies only to the customers’ personal information.
This Trust Services criterion represents the framework by which service organizations are analyzed for SOC 2 compliance. Out of all the five criteria, the Security category is mandatorily required to obtain a SOC 2 audit. Many early-stage startups choose to start their persuasion for SOC 2 compliance with an evaluation of the Security category only.