SOC 2 scope: which Trust Services Criteria to include

Updated 25 October 2026

Security is required in every SOC 2 report. The other four Trust Services categories (Availability, Confidentiality, Processing Integrity and Privacy) are optional, and you include each one only if it matches what you promise customers: uptime, confidential data, accurate processing, or personal information. This guide goes through each category, what a small SaaS team usually decides, and what the choice changes in the documents you write.

Security (the common criteria) is always in scope

The Security category, also called the common criteria, is the foundation of a SOC 2 report. This site maps 33 of them, numbered CC1 to CC9: the control environment, risk assessment, access, system operations, change management and vendor risk. The criteria themselves are published by the AICPA, and each company writes its own controls to meet them. See the SOC 2 controls list for all of them by series. Every source cited below agrees that Security is not optional. If you include nothing else, you still include this.

Availability: when uptime commitments or SLAs make it relevant

Availability is about whether the system is up and recoverable when customers need it. It is relevant when a contract, SLA or order form commits you to uptime or access, or when customers ask about it in security reviews. It adds 3 criteria on capacity, backups and recovery infrastructure, and tested recovery:

• A1.1, capacity management: The company tracks how much of its infrastructure capacity is being used, forecasts demand, and adds capacity before it runs out.
• A1.2, environmental protections, backups and recovery infrastructure: Systems are protected from environmental threats, data is backed up, and the infrastructure needed to recover exists and is designed to meet recovery objectives.
• A1.3, recovery testing: The company actually tests its recovery plan and backup restores on a schedule, records the results, and fixes anything that did not work.

Choosing Availability means the recovery and capacity commitments in your policies are things the auditor tests, not just aspirations. If you have no uptime promise and no customer has asked, you can leave it out for now. Backups and a tested recovery plan are still good practice either way.

Confidentiality: when customers hand you data they treat as confidential

Confidentiality applies to information you have agreed to protect as confidential: customer intellectual property, non-public business data, material covered by an NDA or a confidentiality clause. It adds 2 criteria:

• C1.1, identifying and protecting confidential information: The company defines what counts as confidential, labels or classifies it, and applies handling and retention rules so it stays protected for as long as it is kept.
• C1.2, disposing of confidential information: When confidential information is no longer needed or a customer asks for deletion, the company deletes it from systems and backups within a defined time and can show that it did.

A useful test is to read your customer agreements and look for confidentiality terms with an end date or a deletion obligation. If you have them, the identification and disposal criteria are likely to matter.

Processing Integrity and Privacy: when they apply, and what sources say about a first audit

Processing Integrity concerns whether the system processes data completely, validly, accurately and on time. It fits when you perform calculations or transactions on a customer's behalf and have committed to the result being right, such as payments, billing runs or financial reporting. It is rarely a fit for a product that mostly stores and serves data. Privacy concerns how you collect, use, retain and disclose personal information, and it fits when you collect personal information from end users and want the report to speak to that.

What the published guidance says about including them in a first report:

• risk3sixty recommends starting with Security alone for a first report unless a contract or industry requirement calls for more, and says a Security-only report is no less of a SOC 2. It describes Processing Integrity as relevant to financial transactions or error-free processing, and Privacy as relevant when you handle personal information.
• Vanta says the optional categories only need to be included if they apply to your business, suggests starting with Security if the others do not clearly apply, and notes that adding a category later requires its own observation period.
• Thoropass takes a different line: it suggests Security plus Confidentiality as a starting point, because enterprise customers most often expect the two together, then adding what your customers request.
• Bright Defense ties Processing Integrity to transactional systems such as e-commerce or financial platforms, and Privacy to platforms that collect personal information, particularly in regulated sectors.

These are vendor and consultancy opinions, not rules, and they do not all agree. The common thread is that nobody treats Processing Integrity or Privacy as a requirement for a first report; they are added when a customer or the nature of the service calls for them.

A limit to know about: the Policyseed generator does not offer Processing Integrity or Privacy as scope options. It offers Security, Availability and Confidentiality. The set does include a Privacy and Data Protection Policy, but that policy does not by itself put the Privacy category in scope. If your report will include either category, expect to document more than the generator produces and ask the CPA firm what it needs.

Which categories to include: a quick decision table

If none of the optional rows clearly fits, Security alone is a reasonable first scope. If a customer named a category in a contract or questionnaire, include it. Not sure what customers will want? Run the readiness assessment to see where you stand, then check the industry pages for the categories buyers in your market commonly request.

Scoping the system: products, environments, people and vendors

The categories say which criteria apply; the system says what they apply to. Write down the products and services in the report, the production environments and the infrastructure behind them, the people with access (employees, contractors, the on-call responder), the data the system holds, and the vendors it depends on. A service you do not include has to be described as outside the boundary, and the more of your customer data flows through a vendor, the more that vendor's own SOC 2 report matters (see where to get your vendors' reports). The system description template gives you the structure the CPA firm will ask for, and the report is only as accurate as that description.

How your scope changes your policies

The generator's scope question has three options: Security, Availability and Confidentiality. Security is preselected. The other two change the text of nine of the 22 policies. When Availability is in scope, these policies render added or different wording:

• Information Security Policy: states that the program also covers resilience and recovery of your product.
• Business Continuity and Disaster Recovery Policy: treats the recovery objectives as commitments that need test results and monitoring evidence.
• Logging and Monitoring Policy: adds service level objectives, alerting against them and a monthly availability review.
• Asset Management Policy: adds capacity monitoring with thresholds and a quarterly capacity forecast review.
• Network and Infrastructure Security Policy: requires production workloads to span at least two availability zones or equivalent failure domains.
• Change Management Policy: schedules expected downtime in an announced maintenance window with advance notice to customers.
• Risk Assessment and Management Policy: adds availability to the objectives the risk process protects.

When Confidentiality is in scope:

• Information Security Policy: states that the program also covers information you have committed to keep confidential.
• Data Classification and Handling Policy: defines how information under confidentiality commitments is identified, classified and protected.
• Data Retention and Disposal Policy: keeps disposal records as evidence for the full examination period.
• Risk Assessment and Management Policy: adds confidentiality to the objectives the risk process protects.

Without the category, the same policies still cover the baseline. For example, the Business Continuity and Disaster Recovery Policy says the plan is maintained and tested anyway to meet customer commitments. The difference is that in scope, the wording becomes a commitment the auditor tests. Do not select Availability to look thorough: every sentence it adds is something you then have to operate and show evidence for. The free generator has the scope question if you want to compare the output with and without a category. For the full set and how each policy maps to the criteria, see the SOC 2 policies list.

Questions to settle with your CPA firm before the engagement letter

• Which categories do you recommend for our product and contracts, and why?
• Is a Security-only report acceptable to the customers who asked, or do any of them name a category?
• Which products, environments and subservice organizations belong in the system description?
• If we add a category later, how does the observation period work for it?
• Does your fee change with the number of categories?
• Which Type of report do we start with? (See Type I vs Type II.)

Bring your draft scope and system description to two or three firms and compare what they ask for. The timeline planner shows how your dates move with a category added, with every duration shown as an assumption you can change.

If you'd rather start from a full folder, the Audit Kit ($59, one time) puts the 22 policies in your company's name as editable Word files, tailored to the answers you gave, and adds a system description and a gap assessment draft for the first conversation with a firm.

Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.