A SOC 2 report is an auditor's opinion on a provider's controls, measured against the AICPA's Trust Services Criteria. There are five categories: security, availability, processing integrity, confidentiality and privacy. Security is the one every SOC 2 includes. The provider chooses which of the others to add.
Last reviewed: 17 October 2026. Facts checked. We searched for the five Trust Services Criteria categories and for the 2022 revision of the points of focus. Sources were audit-firm and compliance-vendor commentary. We did not open the AICPA's "2017 Trust Services Criteria with Revised Points of Focus - 2022" document, so we do not list individual criteria numbers or quote its text. We do not state how many criteria exist.
What the criteria are, and what points of focus are
The criteria are the yardstick. The auditor asks: do the provider's controls meet each criterion in scope? The AICPA published the criteria in 2017. In 2022 it revised the points of focus beneath them. Commentary says the criteria themselves did not change.
Points of focus are prompts that help management and the auditor think about what a good control looks like. Sources stress that they are considerations, not a checklist. A provider does not have to show every one to receive a clean report.
The five categories and what auditors test
| Category | The question it answers | Typical tests |
|---|---|---|
| Security | Is the system protected from unauthorised access and misuse? | User access reviews, joiner and leaver samples, password and multi-factor settings, firewall and network rules, vulnerability scans, incident logs |
| Availability | Is the system up when customers need it? | Uptime monitoring, backup runs and restore tests, disaster recovery plan and test, capacity monitoring |
| Processing integrity | Does the system process data completely, accurately and on time? | Input checks, reconciliations, error handling, job scheduling records |
| Confidentiality | Is confidential information protected and disposed of properly? | Data classification, encryption settings, access to confidential data, retention and deletion records |
| Privacy | Is personal information collected, used, kept and disclosed as promised? | Privacy notice, consent and choice records, access requests, disclosure to third parties |
Because security applies to every SOC 2, a good deal of the testing is the same wherever you look: who has access, how change is controlled, how problems are found and handled.
What a security test looks like in practice
Take a simple control: "leavers' access is removed within a set time." The auditor does not take management's word.
- Ask for the full list of leavers in the period from HR.
- Pick a sample of leavers.
- For each, find the date of departure and the date access was switched off in the system.
- Compare against the stated rule.
- Record any exception and ask what happened.
The same pattern works for most controls: get the population, sample it, test against the stated control, record exceptions. For a Type 2 report the sample covers the whole period, not one day.
Evidence a provider should have ready
- A system description that matches how the system really works.
- Policies, with dates and owners, that staff have actually read.
- Lists (employees, leavers, changes, incidents, vendors) that the auditor can sample from.
- Screenshots or system reports for settings, with the date visible.
- Records of reviews, such as access reviews and risk assessments, showing who reviewed and when.
- Vendor management files, including the reports of important suppliers.
A control that is done but not recorded is hard to prove. Most SOC 2 problems come from missing evidence rather than missing controls.
What the report tells you, and what it does not
A clean SOC 2 means the controls in scope met the criteria, in the period tested, in the opinion of the auditor. It does not say the provider cannot be breached. It does not cover systems outside the described scope. Read the exceptions and the scope, as covered in our guide to SOC 1, SOC 2 and SOC 3.
Using the criteria as a customer or internal auditor
If you are reviewing a vendor, you can turn the categories into questions. Which categories are in scope, and why were the others left out? Does the vendor handle personal data but exclude privacy? Do the exceptions touch controls that matter to your use? For internal audit teams, the categories also make a clean frame for a review of your own systems. Our ITGC audit guide covers the access and change controls that sit at the heart of security testing.
Frequently Asked Questions
Is security the only mandatory category?
Sources we checked say security is required in every SOC 2 report, and that availability, processing integrity, confidentiality and privacy are optional. Confirm with the provider which are in scope.
Did the 2022 update change the criteria?
Commentary says the 2022 revision updated the points of focus, not the criteria. We did not read the AICPA text itself.
Do all points of focus have to be met?
No. They are prompts to help judge controls, not a mandatory checklist.
What is the difference between "designed" and "operating"?
Designed means the control would work if followed. Operating means it was followed through the period. Type 2 tests both.
How should a vendor prepare for the audit?
List the controls, assign owners, collect evidence as the work is done, and run a self-check before the auditor arrives.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error