AICPA Trust Services Criteria

What the AICPA Trust Services Criteria Measure

The AICPA trust services criteria are not a product certification and not a generic security checklist. They are the control criteria used to judge whether a service organisation’s controls are suitably designed and operating effectively across security, availability, processing integrity, confidentiality, and privacy.

That scope matters because the criteria define what an assurance engagement is trying to substantiate. A report that references the criteria is asking whether the organisation can consistently meet its stated commitments, not whether it merely has policies on paper.

How the Criteria Structure Assurance Work

The criteria provide the evaluation lens for attestation reports, audits, and readiness assessments. In practice, they shape how scope is defined, which systems are in boundary, and what evidence must exist for control design and operating effectiveness.

Because the criteria are outcome-oriented, they are usually interpreted alongside the service description, control environment, and relevant trust commitments. This is why two organisations may both say they are “SOC 2 ready” while still differing sharply in the depth of evidence, exceptions, and carve-outs they can support.

For teams preparing for review, NHIMG’s SOC 2 Guide is a practical companion because it connects the Trust Services Criteria to scoping, CUECs, and common evidence expectations.

The Five Trust Services Categories

The criteria are organised into five categories: security, availability, processing integrity, confidentiality, and privacy. Security is the common criterion set and is the baseline most engagements rely on, while the other four categories are added when the service’s commitments or data handling require them.

Each category answers a different assurance question. Security asks whether the system is protected against unauthorised access and misuse. Availability asks whether the system is usable as committed. Processing integrity asks whether system processing is complete, valid, accurate, timely, and authorised. Confidentiality asks whether information designated as confidential is protected. Privacy asks whether personal information is collected, used, retained, disclosed, and disposed of according to commitments.

Those distinctions matter because the same service can be strong in one category and weak in another. A provider may have sound access controls yet still fail to demonstrate reliable backup, transaction integrity, or privacy handling for personal data.

Why the Criteria Matter for Vendors and Customers

The Trust Services Criteria are important because they create a shared assurance language between service providers and the organisations that depend on them. Customers use them to understand whether a provider’s controls align with stated commitments, while providers use them to structure control design, evidence collection, and audit readiness.

This is also why the criteria are central to third-party assurance comparisons. A report is only as useful as the scope behind it, and the criteria help readers distinguish a narrow point-in-time review from a broader operational control evaluation.

When organisations need to compare assurance options, NHIMG’s Third-Party Attestation Comparison Map helps place SOC 2 and the Trust Services Criteria alongside other common assurance models. For report interpretation, NHIMG’s How to Read a SOC 2 Report Guide is useful because it explains exceptions, subservice organisations, and carve-outs in practical terms.

What Strong Evidence Usually Looks Like

Evidence under the criteria is usually operational rather than declarative. Auditors look for control design, consistent execution, and proof that controls were active during the review period, such as logs, reviews, change records, access evidence, incident handling, and documented exceptions.

That means the real test is not whether a control exists, but whether it is repeatable and supportable. In assurance work, gaps often appear where organisations have informal practice but cannot prove it consistently enough to satisfy the criteria.

Teams building toward readiness often benefit from a structured control inventory and evidence plan. NHIMG’s SOC 2 Readiness Checklist is especially relevant because it ties the criteria to scope, CC1 to CC9 controls, and evidence planning.

Risk and Threat Considerations

The main risk is false assurance: a provider can appear “SOC 2 compliant” while still carrying material control gaps, weak scope boundaries, or unaddressed exceptions. Because the criteria are used in third-party trust decisions, incomplete evidence or misleading scope can create downstream dependency risk for customers, partners, and regulators.

Failure mechanism: Scope exclusions, weak control design, or unsupported evidence can let a service organisation pass an assurance review without actually controlling the operational risk it represents.

Impact: Customers may rely on a report that overstates control maturity, which can lead to exposure in availability, data handling, access control, or processing outcomes after a vendor incident or service failure.

Practitioner Guidance

Why practitioners should care: Treat the Trust Services Criteria as an assurance target, not a branding exercise. The most common governance mistake is assuming that a passed report means every system, process, and data set in the enterprise is equally covered.

Practitioner note: The most defensible posture is to align scope, evidence, and commitments before the audit starts, then ensure exceptions and carve-outs are documented in language that customers can actually interpret.

Related resources from NHI Mgmt Group

• How do organisations decide whether to scope optional SOC 2 trust services criteria beyond Security?
• How should security teams scope SOC 2 Trust Services Criteria for a SaaS business with cloud and AI data flows?
• How do Trust Services Criteria work?
• How should an organisation implement the Trust Services Criteria?