Skip to content

Trust Services Criteria

Also known as TSC

The five categories a SOC 2 report can cover: security, availability, processing integrity, confidentiality, and privacy.

Security is mandatory and is referred to as the common criteria. The other four are optional and chosen based on what you promise customers, so a report covering security and availability is a different scope from one covering all five.

Reading which categories are in scope is the first thing to check when a vendor sends you their report.

Where this comes up

Trust Services Criteria sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Compliance services Ask an engineer

Related terms

SOC 2 An audit report on how a service organization controls customer data, assessed against the Trust Services Criteria. SOC 2 Type 2 The version of a SOC 2 report that tests whether controls actually worked over a defined observation period. Security control A specific safeguard put in place to reduce risk, whether technical, administrative, or physical.

More in compliance and frameworks

Acceptable use policyAttestationAudit evidenceAudit logBreach notificationBusiness associate agreementBusiness continuity planCardholder data

Back to the full glossary →

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.