SOC 2 — Trust Services Criteria
Security, availability, processing integrity, confidentiality and privacy criteria for service organizations.
- Issued by
- AICPA
- Applies in
- Global standards
- Edition
- TSC 2017 (2022 points of focus)
- Area
- Information security
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- CC1.1Integrity and ethical valuesControl environment
- CC3.2Risk identification and analysisRisk assessment
- CC6.1Logical access securityLogical access
- CC6.6External threats and network securityLogical access
- CC7.2Anomaly monitoringSystem operations
- CC7.4Incident responseSystem operations
- CC8.1Change managementChange management
- CC9.2Vendor and business partner riskRisk mitigation
How Amoreg keeps you on it.
Enable the SOC 2 — Trust Services Criteria and add AICPA’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 8 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read AICPA’s pages
- Check the library against 8 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: integrity and ethical values
- Rule
- SOC 2 — Trust Services Criteria, CC1.1
- Area
- Control environment
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- Cyber EssentialsThe UK government-backed baseline: five technical controls, self-assessed or Plus-audited.United Kingdom · 5 controls
- NYDFS Cybersecurity Regulation (23 NYCRR 500)Cybersecurity requirements for DFS-licensed entities, with CISO, MFA, annual certification and 72-hour notice.United States — New York · 6 controls
- EU Artificial Intelligence ActRisk-based obligations for providers and deployers of AI systems; general-purpose AI duties from August 2025, high-risk from August 2026.European Union · 6 controls
Also in Global standards
- FATF RecommendationsThe 40 Recommendations — the international standard every national AML/CFT/CPF regime is measured against.Global · 8 controls
- Wolfsberg Group StandardsIndustry standards for correspondent banking, the CBDDQ/FCCQ questionnaires and effectiveness-based AML programmes.Global · 4 controls
- ISO 37001 — Anti-bribery management systemsRequirements for establishing, implementing and improving an anti-bribery management system.Global · 6 controls
- ISO 37301 — Compliance management systemsThe certifiable standard for a compliance management system across all obligations.Global · 6 controls
- ISO/IEC 27701 — Privacy information managementThe stand-alone PIMS standard (October 2025 edition), no longer dependent on ISO/IEC 27001.Global · 5 controls
- ISO/IEC 27001 — Information security managementThe certifiable ISMS standard; Annex A controls per ISO/IEC 27002:2022.Global · 9 controls
Questions
Does Amoreg watch for changes to the SOC 2 — Trust Services Criteria?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the SOC 2 — Trust Services Criteria?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records TSC 2017 (2022 points of focus). Editions were last verified in August 2026, and the Monitor records new publications as they appear.