Definition
The trust services criteria (TSC) are published in the AICPA's TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy, with points of focus revised in 2022. They are the suitable criteria a practitioner uses to evaluate whether controls at a service organization were effective to meet its service commitments and system requirements. Security is required in every engagement. Availability, processing integrity, confidentiality and privacy are added when the service organization's commitments call for them.
Why it matters in an audit or review
A SOC 2 or SOC 3 report names the categories in scope. A reader checks that list first, because a security-only report says nothing about whether processing is complete and accurate. Matching categories to the vendor's promises is the first check.
Example
Illustrative: a payroll processor tells customers that payroll runs are complete and accurate and that employee data stays private. A SOC 2 covering security alone leaves those promises untested. A report covering security, processing integrity and confidentiality addresses them.
Common mistakes
- Treating security as the whole report when the vendor's contract promises more.
- Assuming the criteria dictate specific controls.
FAQ
Are the trust services criteria a checklist of required controls?
No. The criteria set objectives. Each entity designs its own controls to meet them, and the practitioner evaluates whether those controls were suitably designed and, for a Type 2 report, operated effectively.
Sources
- AICPA, TSP Section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (With Revised Points of Focus, 2022)
- AICPA, AT-C Section 205, Assertion-Based Examination Engagements
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error