SOC 2 Trust Services Criteria Explained: What They Cover and Which to Include

Which Trust Services Criteria belong in your SOC 2?

Every SOC 2 report covers Security. The other four Trust Services Criteria (Availability, Confidentiality, Processing Integrity and Privacy) are a choice, and the right choice depends on what your customers rely on you for.

This guide explains what each criterion covers, how often each is included, and how to decide which belong in your report.

What are the SOC 2 Trust Services Criteria?

They're the five areas a SOC 2 report can cover. Security is mandatory; the rest are included when they're relevant to your service and your customers.

Is Security always included in a SOC 2?

Yes. The common criteria at the core of every SOC 2 cover Security by default, so including it takes no additional work.

Security also underpins everything else. You can't have confidentiality, availability, processing integrity or privacy without basic comfort over the security of the underlying systems.

Should you include Availability and Confidentiality?

In most cases, yes. Some companies still prefer to start with Security alone, but most mature enterprises want to see Availability and Confidentiality too. Without them, you can end up with a SOC 2 report that doesn't answer all the questions your enterprise customers ask. See getting through enterprise security reviews.

Both are relatively small add-ons. Throughline includes them free with every SOC 2, and we recommend clients include them because they present a more complete picture to enterprises.

There are a few reasons to leave one or both out:

Keeping the first report lean. Some companies exclude them to limit what they take on first, then add them later.

Not ready for Availability yet. Early-stage companies may lack the infrastructure, such as an on-premise system in a single location without environmental controls or a second site. Others have no auto-scaling or capacity forecasting yet, because with trial customers or no revenue, there isn't enough reason to have those processes.

Availability isn't relevant. If you don't commit to uptime, your service isn't critical, or your customer hosts the service in their own environment, Availability may simply not apply.

What does Availability cover?

Availability is about committing to support your service so it's reliable and always available. On-premise, that means redundancy, contingencies, monitoring and backup arrangements. In the cloud, it means having the right processes to monitor the service and keep it reliable.

These questions come up constantly in enterprise due diligence: Do you have backups? Do you have business continuity plans? Is redundancy built into your service? What are your service commitments, and what's your historical uptime?

Security covers some of this by default, but Availability adds a separate dimension to the value of your service. Security is about protection; Availability is about reliability, and customers value it highly.

What does Confidentiality cover?

Confidentiality goes a level beyond Security. Security says all data should be restricted to people with a legitimate business need. Confidentiality recognizes different levels of sensitivity, and expects data to be classified, clearly marked and handled according to its level.

In practice, that means a data classification policy, so people understand each level and why it matters; highly confidential information restricted to the fewest people possible; confidential material, including hard copies, marked so it isn't exposed or shared by accident; and extra levels, such as mission-critical or top-secret data, that need additional clearance where relevant.

Typical controls include data classification, retention and handling policies. They set how long each class of data is kept, what triggers its removal, and how strict system controls are for each class.

The approach should be risk-based. Every system balances convenience against lockdown, and the more sensitive the data, the more it should be locked down. Confidentiality also lays the baseline for Privacy where personal data is involved.

When should you include Processing Integrity?

Include it when your users rely critically on something your service calculates or processes. Processing Integrity is built around completeness and accuracy: is processing complete, and are the outputs accurate against the system's defined objectives?

The controls follow the data through the system:

Inputs. Is all the data needed for the calculation present and correct?

Processing. Is processing monitored, with error reporting and ways to resolve problems?

Outputs. How critical are they, what could go wrong, and how are reported errors handled?

User checks. Are there controls for users reviewing the outputs?

Most reports include a complementary user entity control making users responsible for checking that outputs suit their needs. But some enterprises want assurance that the vendor also takes responsibility for accuracy.

Compliance platforms are a good example. Their automated tests tell customers and auditors whether controls are passing, such as whether encryption is applied to production databases. Processing Integrity lets auditors point to controls over whether those tests can be relied on. See do you need a compliance platform?

When should you include Privacy?

Include it when you handle personal data and your customers need assurance for their own privacy obligations. Privacy regulations such as GDPR apply regardless of SOC 2. Including Privacy in your report shows you have the controls enterprises rely on as data controllers to stay compliant themselves.

The Privacy criteria cover a privacy policy that tells users what data is collected, why, how it's used, and how to exercise their rights; risk assessments, roles and responsibilities, and how personal data is secured; data sovereignty, where data is located, and who controls it; how long personal data is retained; and how privacy and data requests are handled.

Privacy is rarely included because it adds a lot of scope and work, and it's one of the riskier, more sensitive areas of assurance. Where it is included, it can support customers with GDPR and other privacy obligations around the world.

Which criteria should you choose?

Processing Integrity and Privacy are almost always priced as add-ons, while some firms also charge for Availability and Confidentiality. See our guide to the true cost of SOC 2 for what to check in a quote, and our readiness guide for confirming scope early.