Skip to content

Trust Services Criteria

What is Trust Services Criteria?

The five criteria used in SOC 2 audits: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy. Organisations select which criteria apply.

Audit

Related terms

SOC 2

Frameworks that govern trust services criteria

GDPRView framework →ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →

What the standards actually require on trust services criteria

Requirements naming trust services criteria across 6 standards, quoted from the control text.

AICPA SOC 34 controls

SOC 3 uses Trust Services Criteria covering Security, Availability, Processing Integrity, Confidentiality, and Privacy.

SOC3-TSC · Trust Services Criteria Coverage →
SSAE 18 - Attestation Standards (SOC Reporting)2 controls

SOC 3 reports provide an examination opinion on controls relevant to the Trust Services Criteria for general distribution, without the detailed description and test results found in SOC 2.

SSAE-07 · SOC 3 General Use Reports →
Japan AI Guidelines1 control

Third-Party AI Supplier Assurance addresses the complex AI supply chain where most enterprises consume foundation models + cloud AI services + AI-enabled SaaS rather than build from scratch.

JP-AIG-Third-Party-AI-Supplier-Assurance-Foundation-Model-Provider-AISI-Evaluation-Voluntary-Audit · Japan AI Guidelines Third-Party AI Supplier Assurance + Foundation Model Provider + AISI Evaluation + Voluntary Audit + ISO/IEC 42001 AI Management System + Sub-Processor + Cloud AI Service Provider + Open Source AI Governance →
Japan FSA Cybersecurity Guidelines for Financial Institutions1 control

Third-Party + Outsourcing + Cloud Service Provider cybersecurity is critical per FSA Cybersecurity Guidelines + FISC Cloud Guidelines (FISC Anzen Taisaku Kijun - Cloud Computing Edition). (1) Outsourcing Governance: (a) Outsourcing Policy + Board Approval;

JP-FSA-CYB-Third-Party-Outsourcing-Cyber-Risk-Cloud-Service-Provider-Due-Diligence-Audit-Right-Sub-Processor-Visibility-Concentration-Risk · Japan FSA Cybersecurity Third Party + Outsourcing Cyber Risk + Cloud Service Provider Due Diligence + Audit Right + Sub-Processor Visibility + Concentration Risk + Data Sovereignty + ISMAP Certification + FISC Cloud Guidelines →
Kids Online Safety Act (KOSA)1 control

Section 8 of KOSA mandates annual independent audits of covered platforms by qualified third-party auditors. (1) Section 8(a) Annual Independent Audit: (a) Covered platform must commission annual third-party audit;

KOSA-Independent-Audit-Section8-Annual-Third-Party-FTC-Approved-Auditor-Compliance-Verification-Public-Summary · KOSA Independent Audit + Section 8 + Annual + Third-Party + FTC-Approved Auditor + Compliance Verification + Public Summary + Multi-Layer Audit + Risk Assessment Verification + Safeguard Effectiveness + Algorithmic System Audit →
SOC 21 control

Limits the use of personal information to the purposes identified in the entity's objectives related to privacy. The following point of focus, which applies only to an engagement using the trust services criteria for

SOC2-P4.1 · Personal information is used for purposes identified in privacy commitments →

Questions people ask about trust services criteria

What is Trust Services Criteria?
The five criteria used in SOC 2 audits: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy. Organisations select which criteria apply.
Why is Trust Services Criteria important for compliance?
Trust Services Criteria is a key concept in Audit. Understanding trust services criteria helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
What concepts are related to Trust Services Criteria?
Key concepts related to Trust Services Criteria include SOC 2. Understanding these interconnected concepts provides a more comprehensive view of Audit requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Trust Services Criteria?
Trust Services Criteria appears in the requirement text of AICPA SOC 3, SSAE 18 - Attestation Standards (SOC Reporting), Japan AI Guidelines, Japan FSA Cybersecurity Guidelines for Financial Institutions, Kids Online Safety Act (KOSA). Across these standards we have identified 10 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Trust Services Criteria?
Explore our compliance framework pages to see how trust services criteria applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Trust Services Criteria applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.