AICPA TSC 2017 (with 2022 revised POF)

Why it Matters

The AICPA Trust Services Criteria provide a foundation for evaluating and enhancing controls that safeguard critical systems and sensitive data.

Key benefits include:

• Strengthen cybersecurity governance

Establish clear criteria and controls to ensure continuous oversight and accountability for information security practic

• Enhance audit readiness

Enable documentation and evidence-gathering to simplify external audit processes and support SOC attestation requirements

• Increase regulatory alignment

Support compliance with multiple assurance standards and regulations through consistent control objectives and recognized Points of Focus

• Promote operational resilience

Identify and address control gaps that could impact system availability, reliability, and business continuity across organizational environment

• Protect sensitive and confidential data

Reduce the risk of unauthorized access and disclosure by implementing controls tailored to privacy and confidentiality requirements.

How it Works

The AICPA Trust Services Criteria (TSC) 2017, with the 2022 revised Points of Focus (POF), organizes cybersecurity into defined criteria and control families—security, availability, processing integrity, confidentiality, and privacy. Each criterion is accompanied by Points of Focus that outline considerations and expected behaviors, enabling a control catalog approach that ties to risk management processes and governance domains.

Organizations implement the TSC by conducting risk assessments, selecting and implementing security controls mapped to the criteria, and establishing policies and monitoring to demonstrate compliance. Typical activities include control design and testing, evidence collection for assessments, continuous monitoring of security practices, incident response integration, and mapping controls to regulatory requirements and audit programs.

Within SmartSuite, teams can operationalize the AICPA TSC by building control libraries mapped to the POF, maintaining a risk register, governing policies, and collecting evidence against control tests. SmartSuite supports compliance tracking, remediation workflows, audit readiness, and dashboards for monitoring control effectiveness and reporting to governance stakeholders.

Key Elements

• Security, Availability, and Confidentiality Criteria

Specifies structural categories for controls protecting systems against unauthorized access, disruptions, and data disclosure risks.

• Processing Integrity Controls

Describes criteria ensuring accurate, timely, and authorized processing of information in core business systems.

• Privacy Requirements

Outlines data governance and programmatic controls for managing personal information collection, use, retention, and disposal

• Points of Focus Guidance

Establishes specific considerations within each criterion to clarify intent and assist in consistent application.

• Risk and Governance Structure

Defines mechanisms for oversight, accountability, and management of risks associated with information systems and data handling.

• Control Objective Organization

Groups measurable statements that underpin the design, implementation, and operation of effective internal controls.

Framework Scope

AICPA TSC 2017 (with 2022 revised Points of Focus) is adopted by service organizations, technology providers, and entities overseeing customer data or outsourced information systems. It guides the establishment and evaluation of controls over security, availability, processing integrity, confidentiality, and privacy, often when preparing for SOC attestations or demonstrating control effectiveness in assurance engagements.

Framework Objectives

AICPA Trust Services Criteria 2017 (with 2022 revised Points of Focus) provides a foundation for evaluating and enhancing organizational security, privacy, and compliance programs

• Safeguard sensitive data through security controls and risk management practices
• Strengthen cybersecurity governance to promote accountability and oversight
• Enable ongoing compliance with regulatory, contractual, and assurance requirements
• Enhance operational resilience to minimize disruption from cyber threats
• Support effective privacy governance and responsible data protection
• Demonstrate audit readiness and transparency in internal control environments

The AICPA Trust Services Criteria (TSC) 2017 with the 2022 revised. Point of Focus for cybersecurity aligns with and is commonly mapped to NIST CSF, ISO/IEC 27001, and NIST SP 800-53. Organizations implement it for SOC reporting, third party assurance, regulatory compliance, and to formalize security governance and operational controls.

Common Framework Mappings

AICPA TSC 2017is commonly mapped to other cybersecurity and privacy frameworks to simplify audit processes, demonstrate compliance, and strengthen risk management across diverse security and regulatory environments.

Mapped frameworks include:

CIS Critical Security Controls

ISO/IEC 27001

ISO/IEC 27002

ISO/IEC 27018

ISO/IEC 27701

MITRE ATT&CK

NIST Cybersecurity Framework

NIST SP 800-53