Blogs

Every SOC 2 report is built around five Trust Services Criteria, defined in the AICPA Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is mandatory for every SOC 2 report, full stop. The other four are optional, and you only include the ones relevant to what your customers actually need from you, not all five by default.

Here is what each one actually means in plain English, a table showing who needs which, and honest guidance on why most companies starting out only need one of the five. If you are ready to talk specifics, our SOC 2 compliance services start with exactly this kind of scoping conversation.

The 5 Trust Services Criteria at a Glance

What each criterion covers, who actually needs it, and the kind of evidence auditors look for.

Why Most Companies Start Security-Only

Here is the honest part most guides skip: adding all 5 criteria to your first SOC 2 report is not a sign of thoroughness, it is usually unnecessary cost and scope you do not need yet. Every additional criterion means more controls to design, more evidence to collect, and more for your auditor to test, which adds time and money without necessarily adding anything your customers are asking for.

Most companies pursuing their first SOC 2 report start with Security only, because it is the one every customer expects and it is mandatory regardless. The other four get added later, specifically when a customer contract or RFP requires it, not preemptively. A healthtech company handling patient data will likely need Privacy from day one. A B2B SaaS platform without transaction processing probably does not need Processing Integrity at all, ever.

The practical approach: look at what your actual customers and prospects are asking for in security questionnaires and contracts right now, and scope your first report to that. Add criteria later as your customer base and their requirements grow, rather than guessing upfront.

How Your Criteria Choice Changes Cost and Timeline

More criteria in scope means more controls to design, document, and evidence, which directly affects both how long your first audit takes to prepare for and what it costs. A Security-only report is generally the fastest and least expensive path to a first SOC 2 report. Each additional criterion adds roughly 15 to 30 percent to audit fees on its own, not a rounding error, a genuinely separate body of evidence your auditor needs to test, which is why our guide to SOC 2 cost in Australia breaks this down by company size rather than giving a single number.

This is also where the Type 1 versus Type 2 decision interacts with your criteria choice. A Type 1 report, a design snapshot at a single point in time, with more criteria in scope is still generally faster to prepare for than a Type 2 report, which tests operating effectiveness over a 3 to 12 month window, with fewer criteria. The observation period is the bigger time driver in a Type 2 engagement. If you are still deciding between the two, our breakdown of SOC 2 Type 1 vs Type 2 covers how that decision plays out alongside criteria scope.

FAQs