The five SOC 2 Trust Services Criteria, explained

By Sam Rivera, Founder, SentinelPanda · January 30, 2026 · 4 min read · SOC 2

A SOC 2 report covers five Trust Services Criteria, but only one is mandatory. Picking the rest is a scoping decision driven by what you promise customers.

Security: always in scope

Security — the Common Criteria — is the only category every SOC 2 report must cover. It runs from CC1 (Control Environment) through CC9 (Risk Mitigation) and is the workhorse of the framework: governance, risk assessment, access control, change management, monitoring, and incident response all live here. If you only have time for one category, this is the one, and most first reports stop here.

A Security-only SOC 2 is enough to satisfy most enterprise procurement teams. Customers ask "do you have a SOC 2?" — they almost never ask "with which categories?" Adding more is rarely free, so resist the temptation to scope wide on the first attempt.

Availability: when uptime is a contractual promise

Availability covers whether the system is available for operation and use as committed. Include it when you publish or contract to a service-level objective, run a status page that customers rely on, or sell into industries where downtime carries direct financial consequences.

New controls land in capacity planning, environmental protection of the production estate, and the incident response process you already run for outages. If you have a real SRE function and an SLA in your master services agreement, you probably already do this work — adding the category mostly formalises it.

Processing Integrity: when calculations move money or data

Processing Integrity covers whether the system processes data completely, accurately, in a timely manner, and with proper authorisation. It is genuinely relevant for payments processing, billing platforms, payroll, healthcare claims systems, analytics pipelines that drive customer decisions, and similar products. It is over-scoped for a generic SaaS that mostly stores and displays user content.

Auditors will look for input validation, transaction logging, reconciliation, and error handling — the kinds of controls a finance team or data engineering team already designs around. Include it only when "the math is correct" is part of your value proposition.

Confidentiality: when data classification is in your contract

Confidentiality covers whether data designated as confidential is protected as committed. The trigger is usually a contractual classification scheme — your customer agreements call certain fields confidential and you owe specific protections (encryption at rest, restricted access, defined retention, secure disposal).

For most B2B SaaS the practical difference between Security and Confidentiality is small, because the security controls already encrypt and restrict. The category is worth adding when you have customers in regulated industries (financial services, healthcare, legal) who explicitly check for it.

Privacy: when you act as a controller for personal data

Privacy covers whether personal information is collected, used, retained, disclosed, and disposed of in line with the entity's commitments. It overlaps significantly with GDPR and CCPA obligations and is the heaviest of the five categories — notice and consent practices, data subject rights, retention schedules, and onward transfer all come into scope.

If you act mostly as a processor on behalf of customers (typical for B2B SaaS), the Privacy category is usually unnecessary — the customer-controller carries the privacy obligations and your DPA covers your responsibilities. Add Privacy when you act as a controller for end-user data, run a consumer-facing product, or specifically sell into buyers who require it.

How to choose

For a first SOC 2, Security alone is almost always the right call. Add Availability if you publish an SLA. Add Confidentiality if customer contracts use the word. Add Privacy only if you control personal data. Processing Integrity is rarely added — only do it when "we get the math right" is genuinely a customer promise.

Each additional category is more controls to operate, more evidence to collect, and more work for your auditor to test — which shows up on the invoice. The right scope is the smallest that earns the deals you actually want to close.