The Short Answer
Every SOC 2 report includes Security. It's the only mandatory Trust Services Criterion. The other four (Availability, Confidentiality, Processing Integrity, and Privacy) are optional, and you should add one only when it matches a promise you've already made to customers and you can produce evidence for it across the whole audit period.
Not sure which apply to you? The gap assessment recommends your Trust Services Criteria from a few questions about your SLA, data, and transactions, then scores your readiness against them.
The rule that prevents most scoping mistakes: SOC 2 tests whether your controls meet the commitments you make to customers. If your contract promises 99.9% uptime, an auditor and a customer's security team will both expect Availability in scope. If it promises nothing about privacy, adding the Privacy criterion buys you dozens of extra controls and very little credibility.
The Five Trust Services Criteria, Explained
The criteria come from the AICPA's 2017 Trust Services Criteria (with points of focus revised in 2022). Security, also called the Common Criteria, is the foundation. Each optional category adds its own smaller set of criteria on top of it.
| Criterion | Required? | Criteria added | What the auditor tests |
|---|---|---|---|
| Security (Common Criteria, CC1–CC9) | Always | 33 | Governance, risk assessment, access control, change management, system operations, incident response, and vendor risk. The baseline every report covers. |
| Availability (A1) | Optional | 3 | Capacity planning, environmental protections, backups, and tested recovery. Whether the system is available as committed in your SLA. |
| Confidentiality (C1) | Optional | 2 | How you identify, protect, retain, and dispose of information designated confidential: customer data, IP, contracts, and anything covered by an NDA. |
| Processing Integrity (PI1) | Optional | 5 | Whether processing is complete, valid, accurate, timely, and authorized, from inputs through processing to outputs. |
| Privacy (P1–P8) | Optional | 18 | Notice, choice and consent, collection, use and retention, access, disclosure, data quality, and complaint handling for personal information. |
The criteria counts tell you something important: Availability and Confidentiality are light additions, while Privacy nearly doubles the number of criteria an auditor will test beyond Security.
How to Decide: Four Questions
Answer these honestly before you talk to an auditor. They will settle scope for most companies in under an hour.
1. What have you already promised customers?
Read your MSA, SLA, DPA, and order forms. Uptime commitments point to Availability. Confidentiality clauses and NDAs point to Confidentiality. Accuracy guarantees on calculations, payments, or reports point to Processing Integrity. A published privacy notice for end users points toward Privacy.
2. What are customers asking for?
Pull your last ten security questionnaires and lost or stalled deals. If enterprise buyers repeatedly ask about disaster recovery and RTO/RPO, they're asking about Availability. If nobody has ever asked about consent management, Privacy is unlikely to move a deal.
3. What would hurt a customer most if it failed?
If your outage stops a customer's operations, Availability matters. If a calculation error moves money incorrectly, Processing Integrity matters. If a leak exposes their trade secrets, Confidentiality matters. This is the question most aligned with how a customer's risk team reads your report.
4. Can you produce evidence for a full observation period?
A Type II report tests controls across 3–12 months. If you add Availability but haven't tested a restore from backup, you've added an exception, not credibility. It's better to add a criterion at your next audit than to report exceptions in this one.
Which Criteria by Sector
The table below is a starting point, not a substitute for the four questions above. Your contracts and customers always override the sector default.
| Sector | Availability | Confidentiality | Processing Integrity | Privacy |
|---|---|---|---|---|
| Horizontal B2B SaaS | Recommended | Recommended | Usually skip | Usually skip |
| Fintech and financial services | Recommended | Recommended | Recommended if you process transactions or balances | Consider for consumer fintech |
| Healthcare and health tech | Recommended | Recommended | Consider for claims, billing, or clinical calculations | Consider; see HIPAA note |
| Payroll, HR, and benefits | Recommended | Recommended | Recommended | Consider |
| Infrastructure, hosting, and dev tools | Recommended | Recommended | Usually skip | Usually skip |
| Data, analytics, and AI products | Consider | Recommended | Consider if customers act on your outputs | Consider if you process consumer data |
| Consumer apps and e-commerce platforms | Consider | Consider | Consider for order and payment processing | Consider |
Fintech and financial services
Bank and broker vendor-risk teams are among the most demanding SOC 2 readers. Expect Security, Availability, and Confidentiality as the baseline. Add Processing Integrity if your system moves money, calculates balances or interest, reconciles ledgers, or produces figures that flow into a customer's financial reporting. That's exactly the risk PI is designed to address. SOC 2 does not replace PCI DSS if you store, process, or transmit cardholder data. Those are separate obligations. If your controls also affect customers' financial statements, ask whether they need a SOC 1 report as well. SOC 1 covers controls over financial reporting and is a different report entirely.
Healthcare and health tech
Security, Availability, and Confidentiality are the standard scope for vendors handling PHI. Clinical and operational buyers care about uptime and recovery, and PHI is confidential by definition. Add Processing Integrity for claims processing, billing, eligibility, or anything that calculates clinical values. Be careful with Privacy: a SOC 2 report does not make you HIPAA compliant, and the Privacy criterion doesn't map neatly to HIPAA's Privacy Rule. Many health-tech vendors get more value from a SOC 2 that maps controls to the HIPAA Security Rule (sometimes issued as a "SOC 2+" report) than from adding the Privacy criterion. See SOC 2 vs HIPAA and mapping HIPAA to SOC 2 for how the two fit together.
Horizontal B2B SaaS
For most SaaS companies selling to mid-market and enterprise buyers, Security plus Availability plus Confidentiality is the sweet spot. It answers the questions that appear on almost every vendor questionnaire with only five additional criteria. If you're early-stage and need a report quickly to unblock a deal, Security alone is a legitimate starting point. Add Availability and Confidentiality at your next audit period once your SLA and data classification are formalized.
Payroll, HR, and benefits platforms
These platforms calculate pay, deductions, and benefits that employees depend on, so Processing Integrity is usually justified. They also hold sensitive employee personal data, which makes Privacy a reasonable consideration, especially if you interact with employees directly rather than only through the employer.
Infrastructure, hosting, and developer tools
If customers build on top of you, your downtime becomes their downtime. Availability is close to essential. Confidentiality covers source code, secrets, and customer data you host. Processing Integrity and Privacy rarely apply unless you transform customer data or serve consumers directly.
Data, analytics, and AI products
Confidentiality matters most here, because customers send you their data and need to know how it's protected, retained, and deleted, including whether it trains your models. Consider Processing Integrity if customers make decisions directly from your outputs and you have real controls over data pipelines and validation. Don't add it just because the product involves computation. AI governance questions are increasingly answered with ISO 42001 alongside SOC 2; see AI governance controls for SOC 2 and ISO 27001.
Consumer apps and e-commerce platforms
SOC 2 is a B2B trust report, so consumer companies usually pursue it for partners, marketplaces, or enterprise customers. Privacy is more defensible here than anywhere else, because personal data is central to the business. Even so, most consumer companies demonstrate privacy compliance through their GDPR and CCPA programs rather than SOC 2's Privacy criterion.
Get your recommended TSC scope
The assessment asks whether you commit to uptime, process financial transactions, or handle confidential or personal data, then recommends which criteria to include and shows your gaps against them. About 10 minutes, no cost.
The Privacy Criterion Trap
Privacy is the criterion most often added for the wrong reason. Teams include it because "we take privacy seriously," then discover it adds 18 criteria covering notice, consent, data subject access, disclosure tracking, and complaint handling, each requiring documented processes and evidence. Two signals that you probably don't need it yet:
- You process personal data mainly on behalf of business customers (you're the processor, not the controller), and your DPA already defines your obligations.
- No customer, partner, or regulator has asked for it, and your privacy program is already measured against GDPR or CCPA.
Confidentiality is often the better fit. It covers protecting customer data you've agreed to keep confidential, without taking on the full set of consumer-facing privacy obligations. For how the privacy laws themselves compare, see GDPR vs CCPA.
Adding Criteria Later
Your scope isn't permanent. You can add criteria at any future audit period, and many companies start with Security alone, then expand once an SLA or a major customer requires it. The practical constraints:
- Type II needs history. A newly added criterion needs its controls operating across the observation period before it can be reported on, so plan the addition before the period starts, not mid-audit.
- Removing criteria raises questions. Dropping Availability after customers have relied on it invites follow-up from their risk teams. Scope up deliberately.
- Bridge letters don't add scope. A bridge letter covers the gap between report periods for your existing scope only.
How Scope Affects Cost and Effort
Each added criterion means more controls to implement, more evidence to collect, and more auditor testing. Availability and Confidentiality are modest additions, since many of their controls (backups, encryption, data classification) are already expected under Security. Processing Integrity and Privacy are heavier, because they test business processes, not just technical controls. For a full breakdown of audit fees, tooling, and remediation, see How Much Does SOC 2 Cost?. The cheapest scope is the one that matches your commitments exactly, without padding.
Common Scoping Mistakes
- Adding every criterion to look thorough. Readers care whether the right criteria are covered without exceptions, not how many appear on the cover.
- Leaving out Availability while promising uptime. Customer security teams compare your SLA to your report scope and will ask why they don't match.
- Using Privacy as a HIPAA substitute. They're different frameworks. Map to HIPAA directly if healthcare customers need it.
- Choosing scope after hiring the auditor. Decide scope from your commitments first, then get quotes. Scope drives the price, not the other way around.
- Forgetting subservice organizations. Your cloud provider's SOC 2 covers their controls, not yours. Decide whether to carve out or include them, and review their reports annually.
Scope it before you call an auditor
Walk into your first auditor conversation knowing which criteria belong in scope, where your gaps are, and what closing them will cost.
Frequently Asked Questions
Which Trust Services Criteria are required for SOC 2?
Only Security (the Common Criteria) is required. Every SOC 2 report includes it. Availability, Confidentiality, Processing Integrity, and Privacy are optional and should be included based on the commitments you make to customers and the risks your service creates for them.
What is the most common SOC 2 scope?
For B2B SaaS companies, Security plus Availability and Confidentiality is one of the most common scopes, because it answers the questions that appear on most enterprise security questionnaires. Security alone is common for early-stage companies getting their first report.
Do fintech companies need Processing Integrity in SOC 2?
Fintech companies should include Processing Integrity when their system processes transactions, calculates balances or interest, reconciles ledgers, or produces figures customers rely on for financial decisions or reporting. Fintechs that only store or display financial data, without performing those calculations, often don't need it.
Should healthcare companies include the Privacy criterion?
Not automatically. SOC 2's Privacy criterion does not equal HIPAA compliance. Most health-tech vendors include Security, Availability, and Confidentiality, and get more value from mapping their SOC 2 controls to the HIPAA Security Rule than from adding Privacy. Add Privacy when you collect personal information directly from consumers or patients and customers ask for it.
Can I add Trust Services Criteria after my first SOC 2 audit?
Yes. You can add criteria at any future audit period. For a Type II report, the controls for the new criterion must operate throughout the observation period, so decide on additions before the period begins.
Does adding more Trust Services Criteria increase SOC 2 cost?
Yes. Each criterion adds controls, evidence, and auditor testing. Availability and Confidentiality add relatively little because they overlap with Security controls. Processing Integrity and Privacy add more because they test business processes. Matching scope to your actual commitments keeps cost down.