Definition
In TSP section 100, the security category is called the common criteria because the same criteria underlie all five categories. They are numbered CC1 to CC9. CC1 to CC5 follow the COSO internal control components: control environment, communication and information, risk assessment, monitoring activities and control activities. The remaining series cover logical and physical access (CC6), system operations (CC7), change management (CC8) and risk mitigation (CC9). The additional criteria for availability, confidentiality, processing integrity and privacy are labeled A1, C1, PI1 and P1 to P8.
Why it matters in an audit or review
The CC6 to CC8 series line up with the IT general control areas an auditor already tests: access, operations and change. A reader of a SOC 2 report can map exceptions by criterion and see which part of the vendor's environment they affect.
Example
Illustrative: a SOC 2 Type 2 report lists two exceptions under CC6, both involving terminated users whose access was removed late. The user auditor ties those exceptions to the client's own access review and tests whether any of those accounts posted transactions.
Common mistakes
- Reading CC1 to CC5 as technical controls. They are entity-level and governance criteria.
- Ignoring CC9, which addresses vendor and business-disruption risk.
Sources
- AICPA, TSP Section 100, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
- COSO, Internal Control: Integrated Framework (2013)
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error