FAQ: How do we decide which trust services categories belong in our SOC 2?

Begin with what you promise customers and how the service could fail to meet those promises. Security is the foundation; discuss additional categories with the auditor based on the system, commitments, and report users' needs. For example, contractual uptime commitments deserve a specific conversation about availability. Handling personal information deserves a careful privacy discussion, not an automatic assumption that every report must include every category. Keep a short rationale for the selection and confirm it with important customers before signing. Adding categories simply to make a report look more complete can create work without answering a real reporting need.

Related: SOC 2 trust services categories.

Further reading: AICPA SOC 2 reporting guide overview.

Additional FAQs

What does meaningful human review of AI output look like?

Give the reviewer a clear task, enough information, and authority to reject or correct the result. Define what to check, which cases require escalation, and what record to retain. For

How long does a SOC 1 take to complete?

There is no fixed completion time. Estimate three parts: getting controls and evidence ready, the period a Type 2 report will cover, and the auditor’s fieldwork and report review. Some

Does a green automated check prove the control is working?

Not by itself. It provides evidence only about what the check measures, and only if its data and logic are reliable. Ask which systems are included, when the check last

Are screenshots enough for SOC 2 evidence?

Sometimes, but not for every purpose. A screenshot may show a setting at a point in time while leaving out the system identity, date, full population, or change history. An

Can employees put customer data into an AI tool?

Only after the organization has approved that use and confirmed the relevant data, contractual, security, and privacy requirements. Check the provider's applicable terms and settings, including retention, training use, access,

What records should we keep from AI model evaluations?

Keep the purpose of the evaluation, the system and version tested, the relevant configuration, the approved test set or its controlled reference, results, and the reviewer’s decision. Explain the intended

Contact a SOC provider

Vulnerability assessment & penetration testing

Get Our Emails

SOC Reporting Guide