AICPA TSC 2017 (with 2022 revised POF)
- ClassificationCategoryCompliance / Assurance StandardDomainCybersecurityFramework FamilySOC Frameworks
- Regulatory ContextTypeStandardLegal InstrumentStandardSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionNorth AmericaRegion DetailUnited StatesPublisherAmerican Institute of Certified Public Accountants (AICPA)
- VersioningVersion2017 (with 2022 revised Points of Focus)Effective DateDecember 15, 2018Issue Date2017 (revised Points of Focus 2022)
- AdoptionAdoption ModelIndustry RequirementImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
The AICPA publishes the 2017 Trust Services Criteria with revised Points of Focus (2022) as a free download that requires a free AICPA & CIMA account. The text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- The AICPA Trust Services Criteria are the control criteria a CPA applies in SOC 2 and SOC 3 examinations.
- They cover five categories: security, availability, processing integrity, confidentiality, and privacy, with the common criteria applying to every engagement.
- The 2017 criteria with Points of Focus revised in 2022 are aligned to the 17 COSO 2013 principles.
- Nothing is certified: an independent CPA examines the organization and issues a Type 1 or Type 2 report.
- SmartSuite Compliance Management links each control to the criterion it supports, with testing and evidence in the same record.
Overview
The AICPA 2017 Trust Services Criteria (TSP Section 100), with Points of Focus revised in 2022, are the control criteria a CPA applies when examining a service organization's controls over security, availability, processing integrity, confidentiality, and privacy. They are the evaluation criteria for SOC 2 and SOC 3 reports and are also used in SOC for Cybersecurity and SOC for Supply Chain examinations.
The AICPA's Assurance Services Executive Committee (ASEC) issued the criteria for use in attestation or consulting engagements. They are not a law, and nothing is certified: an independent CPA examines the organization and issues a report. A Type 2 report includes an opinion on operating effectiveness over a specified period and describes the tests performed; a Type 1 report carries no such opinion. The common criteria apply to every engagement, and availability, processing integrity, confidentiality and privacy are added when they are in scope.
Teams implement the criteria by defining the system and the categories in scope, mapping each control to the criterion it supports, and keeping evidence the auditor can test. The Points of Focus guide that work, but the criteria do not require an assessment of whether each point of focus is addressed.
Why does it matter?
A SOC 2 report gives customers independent assurance about the controls behind a service, and the Trust Services Criteria define what the auditor tests.
Key benefits include:
- One criteria set, five categories
Scope the report to the categories customers need, from security alone to all five; each added category brings only its own criteria on top of the common criteria.
- Aligned to COSO 2013
The criteria are aligned to the 17 principles of the COSO 2013 Internal Control framework, so control environment, risk assessment and monitoring follow a structure auditors already use.
- Guidance for design and testing
Points of Focus show the characteristics of each criterion, which helps management design controls and helps the practitioner judge them.
- Reuse across SOC engagements
The same criteria serve SOC 2, SOC 3, SOC for Cybersecurity and SOC for Supply Chain examinations, so a program built for one can be extended to the others.
- Defined privacy coverage
The P series sets privacy criteria from notice to monitoring and enforcement for organizations that handle personal information.
How does it work?
The criteria are organized as the common criteria (CC1 to CC9) plus category-specific series: A1 for availability, PI1 for processing integrity, C1 for confidentiality, and P1 to P8 for privacy. CC1 to CC5 follow the COSO principles for control environment, communication and information, risk assessment, monitoring, and control activities. CC6 to CC9 are supplemental criteria for logical and physical access, system operations, change management, and risk mitigation.
An engagement is read against the service organization's commitments and system requirements, and only for the categories in scope. The practitioner may report on any category alone or in combination. In limited cases a criterion that does not apply can be left out; P3.1, for example, does not apply to an organization that does not collect personal information directly from data subjects.
In SmartSuite, Compliance Management links each control to the criterion it supports, with testing and evidence in the same record, and Enterprise Reporting shows status by category and criterion.
Key Elements
- Common criteria (CC1 to CC9)
Nine series apply to every engagement: control environment, communication and information, risk assessment, monitoring, control activities, logical and physical access, system operations, change management, and risk mitigation. CC1 to CC5 carry the 17 COSO principles, and CC9.2 covers risks from vendors and business partners.
- Availability (A1.1 to A1.3)
A1.1 covers monitoring and managing processing capacity, A1.2 covers environmental protections, data backup processes and recovery infrastructure, and A1.3 requires testing of recovery plan procedures. The criteria do not set a minimum performance level.
- Processing integrity (PI1.1 to PI1.5)
Five criteria cover quality information about processing objectives, system inputs, processing, outputs, and stored items, aimed at processing that is complete, valid, accurate, timely, and authorized.
- Confidentiality (C1.1 and C1.2)
C1.1 requires the entity to identify and maintain confidential information and C1.2 to dispose of it. Confidentiality covers any information designated confidential, while privacy covers only personal information.
- Privacy (P1 to P8)
Eight groups cover notice, choice and consent, collection, use, retention and disposal, access, disclosure and notification, quality, and monitoring and enforcement. P6.6 addresses notification of breaches and incidents to affected data subjects, regulators, and others.
- Points of Focus
Each criterion carries Points of Focus, which COSO describes as important characteristics of the criteria. They are guidance and may be customized. The 2022 revision updated the Points of Focus; the criteria remain the 2017 criteria.
What does it cover?
The criteria can be applied across an entire entity, at a subsidiary, division or operating unit, within a function, or to a particular type of information. In a SOC 2 engagement they are applied to a service organization's system and its commitments, and only for the categories included in the scope of the engagement.
What are its objectives?
The criteria exist so that controls can be designed, evaluated, and reported on against a common set of statements.
Evaluate the suitability of design and the operating effectiveness of controls over security, availability, processing integrity, confidentiality, or privacy.
Give management a defined set of criteria, aligned to COSO 2013, to design controls against.
Give users of SOC 2 and SOC 3 reports a common basis for judging a service organization.
Let the scope follow the service, from one category to all five.
Support readiness work as well as attestation, because the criteria may also be used in consulting engagements.
Framework in Context
TSP Section 100 sits beside the AICPA's SOC 2 guide, issued in 2018, which contains performance and reporting guidance for SOC 2 examinations. Organizations commonly map the criteria to ISO/IEC 27001, ISO/IEC 27002, the NIST Cybersecurity Framework, and NIST SP 800-53 to reuse control work across audits.
Common Framework Mappings
SOC 2 control work is often reused across other frameworks; the frameworks below overlap with the Trust Services Criteria.
Mapped frameworks include:
CIS Controls v8.1
ISO 27001:2022
ISO 27002:2022
ISO 27018
ISO 27701
MITRE ATT&CK
NIST CSF 2.0
NIST 800-53 Rev.5
How SmartSuite Supports AICPA TSC 2017 (with 2022 revised POF)
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to hold each control against the criterion it supports, with testing and evidence in the same place.
Criteria-to-control library
Record controls against CC1 to CC9 and the A, PI, C and P series for the categories in scope.
Ownership and review cadence
Assign each control an owner and a review schedule so evidence stays current across the examination period.
Evidence and audit trail
Attach evidence to the control it supports, with timestamps, reviewers and a history the auditor can follow.
Control testing
Plan tests, record results and track exceptions, which supports the operating-effectiveness opinion in a Type 2 report.
Vendor and risk alignment
Link risks and third parties to the criteria they affect, including vendor risk under CC9.2, using Third Party Risk Management.
Reporting for auditors and leadership
Use Enterprise Reporting to show status by category and criterion, with open exceptions.
Related frameworks
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
ISO/IEC 27018:2025 gives guidelines for protecting PII in public clouds acting as PII processors, built on ISO/IEC 27002:2022 with an extended control set.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
MITRE ATT&CK is a free knowledge base of adversary tactics, techniques and sub-techniques from The MITRE Corporation, updated twice a year; the current release is v20.0.
Frequently Asked Questions For AICPA TSC 2017 (Trust Services Criteria)
The Trust Services Criteria are the control criteria, issued by the AICPA's Assurance Services Executive Committee. A SOC 2 report is the result of a CPA's examination of a service organization's controls against those criteria.
No. The common criteria (the CC series) apply to every engagement and cover security. Availability, processing integrity, confidentiality and privacy are added when they are in scope, each with its own criteria series. The practitioner may report on any category alone or in combination.
A Type 2 report includes an opinion on the operating effectiveness of controls throughout a specified period and describes the tests performed and their results. A Type 1 report addresses the same subject matter but contains no opinion on operating effectiveness and no detailed description of tests.
No. The criteria state that their use does not require an assessment of whether each point of focus is addressed, and management may customize a point of focus. The 2022 revision updated the Points of Focus; the criteria are the 2017 criteria.
No. A SOC 2 report is an attestation: an independent CPA issues an opinion on the controls. Write SOC 2 Type II report or SOC 2 attestation, not SOC 2 certified.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.