Your security and compliance glossary

All the terms you need to know when you’re trying to get compliance audit ready, fast.

Show filters

What are the SOC Trust Services Criteria?

The Trust Services Criteria (formerly Trust Services Principles) are control criteria utilized to evaluate and report on the suitability of the design and operating effectiveness of controls relevant to the Security, Availability, Processing Integrity, Confidentiality, or Privacy of an organization’s information and systems. The Trust Services Criteria are established by the Assurance Services Executive Committee (ASEC) of the American Institute of Certified Public Accountants (AICPA).


The five Trust Services Criteria comprise the evaluation structure of a SOC 2 audit and report. All SOC 2 reports include the Security category; the other four categories are optional and a company may include them according to its customers’ needs and its unique business model.


Category
Description
Security
Systems and data stored by a company are protected against unauthorized access and unauthorized disclosure.
Availability
Information and systems are available for operation and use.
Confidentiality
Confidential information is protected.
Processing integrity
System processing is complete, valid, accurate, timely, and authorized. Customer data remains correct throughout the course of data processing.
Privacy
Personal information is collected, used, retained, disclosed, and disposed of in accordance with pre-stated policies.

Although the Confidentiality category applies to any sensitive information, the Privacy category applies only to personal information.

The Trust Services Criteria represent the framework by which organizations are evaluated for SOC 2 compliance. Of the five criteria, the Security category is required to obtain a SOC 2 audit, and many early-stage startups may choose to start the SOC 2 process with an evaluation of the Security category only.

Additional resources you might like:

Compliance
Event
Ask Me (Almost) Anything: AI & Compliance

What does AI mean for your company’s security compliance program? Join our session on 28 March 9 am AEDT where Matt Cooper, Privacy, Risk and Compliance Manager at Vanta, and Noam Rubin, Sr. Software Engineer at Vanta, will answer (almost) all your questions about AI and compliance.

Compliance
Event
Automating SOC 2 compliance & more

Join Vanta’s 45-minute live product demo on March 12 at 11 am PST where Devin and Natalie will walk you through the Vanta platform and show you how we automate 90% of the work for security and privacy frameworks, and help you move towards a state of continuous compliance.

Compliance
Event
ISO 27001 & SOC 2 Compliance Automation

Join Vanta’s 45-minute live product demo on 13 March at 11 am GMT. Two of our team members will walk you through the platform and answer questions throughout the session.

Get compliant and
build trust, fast.

Two wind turbines on a white background.