Skip to content

Trust Services Criteria

What is Trust Services Criteria?

The five criteria used in SOC 2 audits: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy. Organisations select which criteria apply.

Audit

Related terms

SOC 2

Frameworks that govern trust services criteria

GDPRView framework →ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →

What the standards actually require on trust services criteria

Requirements naming trust services criteria across 3 standards, quoted from the control text.

CSA STAR (Security, Trust, Assurance, and Risk)1 control

STAR Attestation, developed by CSA with the AICPA, is a SOC 2 engagement performed by a CPA firm using the AICPA Trust Services criteria together with the CCM, giving an independent third-party assessment of the cloud provider;

csa-star-security-trust-assurance-and-risk::L2-ATTEST · Obtain STAR Attestation through a SOC 2 examination that adds the CCM criteria, and renew it yearly →
Kids Online Safety Act (KOSA)1 control

Section 8 of KOSA mandates annual independent audits of covered platforms by qualified third-party auditors. (1) Section 8(a) Annual Independent Audit: (a) Covered platform must commission annual third-party audit;

KOSA-Independent-Audit-Section8-Annual-Third-Party-FTC-Approved-Auditor-Compliance-Verification-Public-Summary · KOSA Independent Audit + Section 8 + Annual + Third-Party + FTC-Approved Auditor + Compliance Verification + Public Summary + Multi-Layer Audit + Risk Assessment Verification + Safeguard Effectiveness + Algorithmic System Audit →
SOC for Cybersecurity - Cybersecurity Risk Management Examination1 control

Management makes two assertions: that its description meets the description criteria, and that the program's controls achieved the cybersecurity objectives when measured against a set of control criteria. DC 200 does not supply the control criteria;

soc-for-cybersecurity-cybersecurity-risk-management-examination::MGT-2 · MGT-2 Management asserts on the description and on control effectiveness against suitable control criteria it selects →

Questions people ask about trust services criteria

What is Trust Services Criteria?
The five criteria used in SOC 2 audits: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy. Organisations select which criteria apply.
Why is Trust Services Criteria important for compliance?
Trust Services Criteria is a key concept in Audit. Understanding trust services criteria helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
What concepts are related to Trust Services Criteria?
Key concepts related to Trust Services Criteria include SOC 2. Understanding these interconnected concepts provides a more comprehensive view of Audit requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Trust Services Criteria?
Trust Services Criteria appears in the requirement text of CSA STAR (Security, Trust, Assurance, and Risk), Kids Online Safety Act (KOSA), SOC for Cybersecurity - Cybersecurity Risk Management Examination. Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Trust Services Criteria?
Explore our compliance framework pages to see how trust services criteria applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Trust Services Criteria applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.