What it is
This matrix maps controls to the Trust Services Criteria. Each row records the control, owner, frequency, type, system, TSC category, criteria references, evidence expected, test procedure, population, sample, last test date, result and status.
A coverage tab lists the common criteria groups CC1 through CC9 plus availability, processing integrity, confidentiality and the eight privacy groups, counts the controls mapped to each and flags in-scope groups that have none. It is a readiness and planning tool and does not represent any organization’s control environment or report status.
When to use it
- Building the control inventory ahead of a SOC 2 examination.
- Finding criteria that no control addresses.
- Tracking readiness testing and remediation by control.
What’s inside
- Controls tab: one hundred rows with mapping, evidence, testing and status
- Criteria coverage tab with a mapped control count and gap flag
- Summary by category and result
- Legend with the Trust Services Criteria notes
Standard cited
This template follows AT-C 205 / TSC. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
How do I map a control to criteria?
Type the references in the Criteria references column separated by commas, for example CC6.1, CC6.2. The coverage tab counts controls whose references name each group.
Are the criteria titles the official text?
No. They are short paraphrases for navigation. Use the current AICPA Trust Services Criteria for the exact criteria and points of focus.
Does completing the matrix mean a company is SOC 2 compliant?
No. SOC 2 is an attestation report from an independent service auditor. This matrix is for readiness and does not state or imply that any organization holds a report.
Related templates
- SOC 2 Readiness Checklist (Trust Services Criteria)
- ITGC Testing Matrix: Access, Change and Operations
- SOX Risk and Control Matrix (RCM)
Last updated 11/05/2026. All free templates.