SOC 2 testing requirements

What SOC 2 requires under the Trust Services Criteria

The AICPA Assurance Services Executive Committee publishes the criteria as TSP Section 100, the 2017 Trust Services Criteria with revised points of focus from 2022 (AICPA & CIMA, checked on 2026-09-16). The 2022 revision changed the points of focus only; the 2017 criteria stayed the same. The system description in a SOC 2 report follows the 2018 SOC 2 Description Criteria (DC 200), with implementation guidance revised in 2022.

A SOC 2 examination covers one or more of five categories: security, availability, processing integrity, confidentiality, and privacy. Security uses the common criteria CC1 to CC9. Each other category adds its own series: A for availability, PI for processing integrity, C for confidentiality, and P for privacy.

The criteria describe outcomes, and each entity chooses its own controls. Management may customise points of focus that do not fit the entity. SOC 2 therefore sets no fixed scan interval or test calendar. The service auditor tests the controls that management describes.

A type 2 SOC 2 report gives an opinion on operating effectiveness throughout a specified period and describes the auditor's tests of controls and their results. A type 1 SOC 2 report addresses the same subject matter without either of those parts.

For software teams, most of the test scope sits in these criteria:

• CC6.1, logical access. The entity restricts logical access to protected information assets. The points of focus name APIs, multifactor authentication, encryption, protection of cryptographic keys, and a security assessment of new architectures before implementation.
• CC6.2 and CC6.3, credentials and roles. Credentials are issued on authorisation and removed when access is no longer authorised. Access follows roles, least privilege, and segregation of duties.
• CC6.6 and CC6.7, boundaries and transmission. The entity protects against threats from outside its system boundaries and protects information during transmission.
• CC4.1 and CC7.1, evaluations and vulnerabilities. CC7.1 expects detection of configuration changes that introduce vulnerabilities and of newly discovered vulnerabilities. Its point of focus describes periodic vulnerability scans, scans after significant change, and timely remediation. The 2022 point of focus for CC4.1 lists penetration testing among possible separate evaluations.
• CC8.1, change management. The entity authorises, designs, develops, configures, documents, tests, approves, and implements changes. The points of focus cover testing before production (unit, integration, regression, static and dynamic analysis, automated testing), segregation so that one person cannot develop and deploy a change alone, emergency changes, and patches. When confidentiality is in scope, confidential information stays protected during testing.
• A1.2 and A1.3, recovery. Backup and recovery infrastructure exists, and recovery plan procedures are tested. A point of focus under A1.3 describes periodic tests of backup integrity and completeness.
• PI1.2 to PI1.5, processing integrity. Inputs, processing, outputs, and stored items are complete, accurate, and timely against the system specifications.