Understanding the Updated SOC 2 Trust Services Criteria

Outsourcing IT services to service organizations has become a normal part of doing business, even for small companies. However, there are risks to using service providers, and these continue to evolve and change. In this dynamic environment, the American Institute of Certified Public Accountants (AICPA) made some changes to the SOC 2 Trust Services Criteria in April 2017, effective for all SOC 2 attestations with period ends after December 15, 2018.

If your company is issuing an SOC 2 attestation this year and moving forward, you must map your controls to the new SOC 2 Trust Services Criteria requirements.

The SOC 2 Trust Services Principles are now the Trust Services Criteria

AICPA has renamed what used to be called the Trust Services Principles, or the Trust Services Principles and Criteria. They are now known as the Trust Services Criteria. Additionally, the five principles that comprise the criteria are now called the Trust Services Categories.

What are the five criteria categories?

* Information and systems are protected against unauthorized access, unauthorized disclosure of information, and damage to systems that could compromise the availability, integrity, confidentiality, and privacy of information or systems and affect the entity’s ability to meet its objectives.
* Information and systems are available for operation and use to meet the entity’s objectives.
* System processing is complete, valid, accurate, timely, and authorized to meet the entity’s objectives.
* Information designated as confidential is protected to meet the entity’s objectives.
* Personal information is collected, used, retained, disclosed, and disposed to meet the entity’s objectives.

Security is the only Trust Services Criteria category that organizations are required to include in their SOC 2 attestations. Organizations can attest to controls in the security category only or pair it with any or all of the other categories.

Integration with the 2013 COSO Framework

To better address cybersecurity risks and expand the assessment environment, the SOC 2 Trust Services Criteria have been integrated with the 2013 COSO Framework. Developed by the Committee of Sponsoring Organizations of the Treadway Commission, the framework was designed so that publicly traded companies could assess and report on their internal controls. This integration was the driving force behind renaming the SOC 2 Trust Services Criteria, as the old nomenclature would have caused confusion with the terms used in the 2013 COSO Framework.

The 2013 COSO Framework contains 17 principles, which are grouped under five internal control classifications:

* Communication and Information
* Control Environment
* Monitoring Activities
* Risk Assessment
* Control Activities

If your organization has issued an SOC 2 report previously, you will likely have to restructure your controls to comply with the new integration.

Additionally, service organizations will have to include the “points of focus” required by COSO, which are new to SOC 2 attestations. Each Trust Services Criteria category now has several points of focus that detail the features that should be included in the design, implementation, and operation of the control related to that criterion. Not all points of focus will apply to every organization.

Which Trust Services Criteria categories apply to your company?

The first step to issuing an SOC 2 attestation is determining which Trust Services Criteria categories to include. All of them may be applicable to your service organization, or perhaps only security will be relevant. Make sure to get advice from SOC 2 experts such as the professional SOC 2 auditors at Continuum GRC.