supernav-iconDrataverse - June 22 | Drata’s user and compliance summit
Drata Wordmark Black
  • Solutions
    • Platform
      • Startup
      • Scale
      • Audit Hub
      • Trust Center
      • Risk Management
      • Open API
      • Integrations
    • Frameworks
      • SOC 2
      • ISO 27001
      • HIPAA
      • GDPR
      • Custom Frameworks
      • All Frameworks
    • SOC 2 Compliance: A Beginner's Guide
      Access the Guide
      SOC 2 Guide
  • Resources
    • Resources
      • Blog
      • Drata Events
      • Webinars
      • Reports
      • Compliance Glossary
      • Community
      • API Documentation
    • June 22: Attend Drata's Inaugural User and Compliance Summit
      Register
      Attend Drata's Inaugural User and Compliance Summit
  • Auditors
  • Customers
  • Company
    • Company
      • Careers
      • Auditors
      • Partners
      • Press
      • Security
      • Contact Us
    • Drata Named One of the Best Workplaces in Technology
      Read More
      Drata Linkedin Global Nav
  • Sign In
  • Get Started
  • Sign In
  • Get Started
HomeCompliance GlossaryWhat are the SOC Trust Services Criteria (TSC)?

What are the SOC Trust Services Criteria (TSC)?

The Trust Services Criteria (formerly Trust Services Principles) are control criteria utilized to evaluate and report on the suitability of the design and operating effectiveness of controls relevant to the Security, Availability, Processing Integrity, Confidentiality, or Privacy of an organization’s information and systems. The Trust Services Criteria are established by the Assurance Services Executive Committee (ASEC) of the American Institute of Certified Public Accountants (AICPA).

The five Trust Services Criteria comprise the evaluation structure of a SOC 2 audit and report. All SOC 2 reports include the Security category; the other four categories are optional and a company may include them according to its customers’ needs and its unique business model.

  • Security:

     Systems and data stored by a company are protected against unauthorized access and unauthorized disclosure.

  • Availability:

     Information and systems are available for operation and use.

  • Confidentiality:

     Confidential information is protected.

  • Processing Integrity:

     System processing is complete, valid, accurate, timely, and authorized. Customer data remains correct throughout the course of data processing.

  • Privacy:

     Personal information is collected, used, retained, disclosed, and disposed of in accordance with pre-stated policies. Although the Confidentiality category applies to any sensitive information, the Privacy category applies only to personal information.

The Trust Services Criteria represent the framework by which organizations are evaluated for SOC 2 compliance. Of the five criteria, the Security category is required to obtain a SOC 2 audit, and many early-stage startups may choose to start the SOC 2 process with an evaluation of the Security category only.

Join the thousands of companies that trust Drata

See All Case Studies
Abnormal Logo
Airbase
BambooHR Logo
BigID Logo
Clearbit Logo
Clearco Logo
Lemonade Logo
Fivetran Logo
Notion Logo
Vercel Logo
Wordpress VIP
Calendly Logo

View Drata Glossary

Learn more about other compliance and cybersecurity concepts in our glossary.

Read More
Drata Wordmark White

Drata is a security and compliance automation platform that continuously monitors and collects evidence of a company’s security controls, while streamlining workflows to ensure audit-readiness.

Solutions

StartupScaleEnhanceDrata PlatformIntegrations
Frameworks
SOC 2ISO 27001HIPAAGDPRCustom FrameworksAll Frameworks
Resources
BlogDrata EventsWebinarsReportsCompliance GlossaryCommunityAPI Documentation
Company
Careers
HIRING
CustomersAuditorsPartnersPressContact Us
Trust
Security and ComplianceTrust CenterSystem Status
Become a Trusted Newsletter Insider

The latest security and compliance news, delivered.

Secured DesktopSecured Desktop

© 2023 Drata Inc. All rights reserved.

Privacy PolicyGDPRTermsCookiesDisclosure PolicySub-processorsData Processing Addendum