The Executive Guide to AICPA SOC 2 Scoping and Trust Services Criteria (TSC)
AICPA SOC 2 (System and Organization Controls 2) is the standard-bearer for B2B cybersecurity audits in North America. For modern SaaS providers, data processing institutions, and managed IT organizations, presenting a clean SOC 2 Type II audit report is frequently a non-negotiable prerequisite to signing mid-market and enterprise accounts.
Unlike rigid compliance checkmarks, SOC 2 is highly customizable. It is designed around five core Trust Services Criteria (TSC). Correctly scoping which criteria are mandatory for your service organization prevents "scope creep," which can inflate your CPA audit fees, overwhelm internal engineers, and result in long delayed compliance roadmaps.
1. Understanding the Five Trust Services Criteria
The AICPA framework includes the following criteria, with Security serving as the mandatory foundation:
- Security (Common Criteria): Focuses on network protection, physical controls, logical access limits (MFA, SSO), vulnerability discovery, incident response, and change authorization. Every SOC 2 report must audit the Security criteria.
- Availability: Examines whether systems are operational and available to meet commitments in service level agreements (SLAs). Key elements include disaster recovery testing, offsite redundant backups, data replication, and auto-scaling capacity monitoring.
- Confidentiality: Governs data classified as confidential by contracts, customer agreements, or regulatory categories. Focuses heavily on end-to-end data encryption (AES-256), secure key rotations, structured data classification policies, and certified hardware sanitization.
- Processing Integrity: Validates whether applications process inputs completely, accurately, and within authorized guidelines. Essential for fintechs, billing gateways, and data processing nodes that must prevent transaction duplication or database mismatch errors.
- Privacy: Evaluates personal information (PII) collection, usage, retention, and deletion practices against the AICPA's strict Privacy principles. Critical for companies dealing directly with consumer health records or managing European/California user profiles.
2. SOC 2 Type I vs. SOC 2 Type II Reports
Organizations typically proceed through two distinct certification phases:
- SOC 2 Type I: Audits the design of your controls at a specific point in time. It proves that you have documented policies, MFA is active, and server monitoring is operational on the day the auditor evaluates the system. Excellent for initial marketing needs.
- SOC 2 Type II: Audits both the design and operational effectiveness of your controls over a continuous observation window (typically 3, 6, or 12 months). The auditor collects systematic samples to verify that policies were continuously active and never bypassed.
3. How to Remediate Gaps Before the Audit Starts
CPA firms perform independent, adversarial audits. If they find systematic exceptions (e.g. key developers committing code without peer approval or databases stored without encryption), they may issue a "qualified opinion" or adverse report, which damages your commercial reputation.
Prior to scheduling the audit, run a complete gap assessment using the tool above. Remediate any controls marked as "Not Implemented" by setting up modern tooling: use infrastructure-as-code to enforce server setups, secure cloud access with Single Sign-On, draft a complete incident response document, and run automated recovery drills on your production database backups.