Trust Services Criteria

The Trust Services Criteria, also formerly known as the Trust Services Principles, are a set of control criteria used to evaluate, analyze and report on the suitability of the design and operating effectiveness of controls relevant to five sections of an organization’s information and systems. 

These five principles are- Security, Availability, Processing Integrity, Confidentiality, or Privacy. These Trust Services Criteria have been established by the Assurance Services Executive Committee (ASEC) that falls under the American Institute of Certified Public Accountants (AICPA).

Every SOC 2 audit structure and report comprises these five Trust Services Criteria depending on their relevance. Both types of SOC 2 reports consist of the Security category. However, the other four categories are optional and may or may not be included by a company according to the needs of their customer and their own distinct business model.

The five categories for trust service criteria have been explained under. 

Category Description
SecuritySystems and data within the hold of a company are protected against unauthorized access and unauthorized disclosure.
AvailabilityInformation and systems that are available for effective operation and usage.
ConfidentialityConfidential information about clients and businesses is protected and secure.
PrivacyAll personal information is collected, retained, disclosed, used and disposed of in relevance with the pre-stated rules and policies.
Processing integrityEntire system processing is valid, accurate, complete, timely, and authorized. Client data remains correct over the entire course of data processing.


The trust criteria also mention that the Confidentiality TSC applies to all kinds of sensitive information, whereas the Privacy TSC applies only to the customers’ personal information.

This Trust Services criterion represents the framework by which service organizations are analyzed for SOC 2 compliance. Out of all the five criteria, the Security category is mandatorily required to obtain a SOC 2 audit. Many early-stage startups choose to start their persuasion for SOC 2 compliance with an evaluation of the Security category only.

See Scrut in action!