What Are the Trust Services Criteria?

The AICPA's Trust Services Criteria (TSC) are the framework your SOC 2 auditor uses to evaluate your controls. There are five categories. Every SOC 2 report must cover Security (CC). The other four are optional — included only if you choose to commit to them.

Most SaaS companies start with Security only. Adding Availability is common once you have SLA commitments. Privacy is increasingly requested by companies handling consumer data.

1. Security (CC) — Required

What it covers: Protection of information and systems from unauthorized access, disclosure, modification, and destruction.

Common controls evaluated:

• Multi-factor authentication (MFA) on privileged accounts
• Encryption at rest and in transit
• Vulnerability management and patching
• Access control and least-privilege
• Logging, monitoring, and alerting
• Incident response procedures
• Vendor risk management
• Background checks and security training for employees

Why it matters: This is the foundation. Every SOC 2 engagement covers security. If your AWS IAM configuration, S3 bucket policies, or CloudTrail setup are weak, this is where it shows.

2. Availability (A)

What it covers: The system is available for operation and use as committed — your uptime SLAs, recovery objectives, and disaster recovery plans.

Common controls evaluated:

• Uptime monitoring with alerting
• Documented Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
• Backup and restore procedures — and evidence that restores are tested
• Capacity planning
• Incident response runbooks for outages

Include if: You've made SLA commitments to customers (e.g., 99.9% uptime) or sell to customers whose own compliance requires availability controls.

3. Processing Integrity (PI)

What it covers: System processing is complete, valid, accurate, timely, and authorized.

Common controls evaluated:

• Input validation
• Error handling and exception logging
• Processing reconciliation (e.g., all records processed, no silent data loss)
• Job scheduling and completion monitoring

Include if: You run financial calculations, data processing pipelines, or any system where incorrect output causes customer harm. Less common for pure SaaS platforms without data processing commitments.

4. Confidentiality (C)

What it covers: Information designated as confidential is protected as committed or agreed.

Common controls evaluated:

• Identification and classification of confidential data
• Encryption of confidential data
• NDA requirements for employees and vendors
• Data retention and disposal procedures

Include if: Your service agreement includes confidentiality commitments beyond basic security — e.g., you promise to never share customer data with competitors, or you handle M&A-sensitive information.

5. Privacy (P)

What it covers: Personal information is collected, used, retained, disclosed, and disposed of in accordance with your privacy notice and applicable regulations.

Common controls evaluated:

• Consent for data collection
• Privacy policy accuracy
• Data subject rights (access, deletion, correction)
• Data retention schedules
• Third-party data sharing controls

Include if: You collect or process personal information from consumers (not just B2B data), or your customers are in regulated industries like healthcare or finance.

What SecureSpect Monitors

SecureSpect focuses on the technical controls within Security and Availability — the AWS and GitHub configurations that automated checks can evaluate. Organizational controls (policies, training, vendor agreements) require human processes that we help you track as manual evidence items.