AI with receipts: cybersecurity readiness, secure infrastructure, human expertise. +1-404-333-2968  ยท  admin@aitechpros.ai

AI Tech Pros

TSC Criteria Decoder

The SOC 2 Trust Services Criteria, translated into plain English. Search and filter all 61 criteria, see what evidence each one really needs, and take the scoping quiz to learn which categories likely apply to your business.

Educational aid only. Not an audit, attestation, CPA opinion, or legal advice. Confirm your engagement scope with a licensed CPA firm.

Which categories do I need?

Answer six plain-English questions about your business. The decoder recommends which Trust Services categories likely belong in your SOC 2 scope, with reasoning you can share with your CPA firm. Security is always in scope: the Common Criteria apply to every SOC 2 engagement.

1. Do customers, contracts, or SLAs require uptime or availability commitments?
2. Do you process transactions, calculations, or reports that customers rely on to be correct?
3. Do you store or handle data that customers call confidential?
4. Do you collect, store, or process personal information about individuals?
5. Are you a SaaS, cloud, or hosted-service provider?
6. Do enterprise customers or RFPs ask you for a SOC 2 report?

This is guidance, not a scoping decision. Confirm your engagement scope with a licensed CPA firm before committing to categories.

Criteria counts at a glance

Security's 33 Common Criteria are mandatory in every SOC 2. The other four categories are optional and are added only when your commitments and business require them.

Decode SOC 2 Trust Services Criteria into plain English. Free reference tool by AI Tech Pros.