Five categories, one required
Every SOC 2 includes Security. The other four are optional. Add them when your customers' commitments call for them, not because more categories look better. Each category you add expands the audit and the evidence you'll need.
| Category | Criteria | Include it when |
|---|---|---|
| Security | CC1–CC9 | Always. These are the common criteria. |
| Availability | A1.1–A1.3 | You commit to uptime in SLAs, or customers depend on you staying up. |
| Confidentiality | C1.1–C1.2 | You handle data contractually designated confidential, like customer IP or financial data. |
| Processing integrity | PI1.1–PI1.5 | Customers rely on you to process transactions completely and accurately (payments, payroll, calculations). |
| Privacy | P1–P8 | You collect personal information directly from individuals and make privacy commitments to them. |
The common criteria (CC1–CC9)
The Security category is made up of 33 criteria in nine series. CC1 through CC5 follow the COSO 2013 internal control framework. CC6 through CC9 cover technical operations and risk mitigation.
| Series | What it covers | Criteria |
|---|---|---|
| CC1 | Control environment Leadership oversight, org structure, hiring, background checks, code of conduct, accountability. | 5 |
| CC2 | Communication and information Security policies people can find, internal communication, and how you tell customers about commitments and changes. | 3 |
| CC3 | Risk assessment A documented risk assessment, including fraud risk and how changes in the business affect risk. | 4 |
| CC4 | Monitoring activities Checking that controls work, and fixing what doesn't. | 2 |
| CC5 | Control activities Choosing controls that address your risks, including technology controls, and putting them into policy. | 3 |
| CC6 | Logical and physical access SSO, MFA, provisioning and deprovisioning, access reviews, encryption, network boundaries, endpoint protection. | 8 |
| CC7 | System operations Vulnerability management, logging, monitoring, alerting, incident response and recovery. | 5 |
| CC8 | Change management Changes to infrastructure and code are authorized, tested, reviewed and approved. | 1 |
| CC9 | Risk mitigation Business continuity, insurance, and vendor and business-partner risk management. | 2 |
Points of focus
Each criterion comes with points of focus, which describe characteristics a control might have. They're guidance. You don't have to address every point, and your auditor will judge whether your controls meet the criterion as a whole. That leaves room to design controls that fit your company rather than copying a template.
One control, many criteria
Good control sets are smaller than people expect. A single well-run quarterly access review can support several CC6 criteria. Most first-time SOC 2 programs land somewhere between 60 and 120 controls, depending on scope and how they're split up.
Write each control as something a person or system actually does, on a schedule, with evidence. "Engineering leads review production access quarterly and record approvals in the ticketing system" is auditable. "Access is appropriately restricted" isn't.