Trust Services Criteria

Trust Services Criteria
Name	Trust Services Criteria
Established	2017 (current form)
Fields	Information security, assurance, risk management
Owner	AICPA
Related	SOC 2

Trust Services Criteria The Trust Services Criteria constitute a set of professional audit standards used to evaluate controls relevant to information security, availability, processing integrity, confidentiality, and privacy. Developed and maintained by professional bodies, these criteria are applied by practitioners, auditors, boards of directors, and regulators to assess service organizations, cloud providers, and technology vendors. They integrate with widely used assurance frameworks and feed into contractual, regulatory, and governance processes across industries.

Overview

The Trust Services Criteria originated from efforts by the American Institute of Certified Public Accountants and related bodies to update attestation guidance following developments in cloud computing, outsourcing, and cybersecurity incidents. The criteria map to control objectives drawn from standards such as International Organization for Standardization ISO/IEC 27001 and guidance from National Institute of Standards and Technology. Practitioners from Big Four accounting firms, independent public accounting firms, and in-house compliance teams rely on the criteria when preparing SOC 2 reports, negotiating service agreements with providers like Amazon Web Services, Microsoft Azure, and Google Cloud Platform, or responding to inquiries from agencies such as the Securities and Exchange Commission and financial regulators like the Federal Reserve System.

Criteria Categories

The criteria are organized into five principle-based categories: security, availability, processing integrity, confidentiality, and privacy. The Security category—often mandatory for attestation—covers controls against threats such as unauthorized access or data breaches referenced in cases like the Equifax data breach and incidents affecting Target Corporation. Availability relates to resilience and disaster recovery planning seen in events such as disruptions from Hurricane Katrina or outages experienced by major platforms like Facebook. Processing Integrity addresses accuracy and completeness requirements relevant to systems used by firms such as Visa and Mastercard. Confidentiality overlaps with protections invoked in litigation involving companies like Dropbox or Box, Inc.. Privacy maps to legal regimes exemplified by the General Data Protection Regulation and the California Consumer Privacy Act, aligning with expectations set by authorities like the Office of the Privacy Commissioner.

Implementation and Assessment

Implementation begins with scoping: identifying relevant systems, boundaries, and complementary laws such as the Health Insurance Portability and Accountability Act for healthcare entities including Kaiser Permanente or Mayo Clinic. Organizations perform risk assessments using methods influenced by publications from ISACA and models from NIST Special Publication 800-53. Controls may draw upon technical standards from vendors like Cisco Systems, Palo Alto Networks, and VMware or workflow tools from providers such as ServiceNow and Splunk. Independent assessors—often certified public accountants affiliated with firms like Deloitte, PwC, EY, and KPMG—test design and operating effectiveness through inquiries, inspections, and testing procedures. Third-party attestations require coordination with legal teams, boards modeled after governance practices at firms like General Electric or IBM, and integration with enterprise risk management frameworks inspired by COSO.

Reporting and Certification

Attestation under the criteria commonly produces SOC 2 Type I or Type II reports used by customers, auditors, and procurement teams at companies such as Salesforce and Slack Technologies. Type I addresses design of controls at a point in time; Type II assesses operating effectiveness over a period, a distinction mirrored in auditing literature by scholars affiliated with American Accounting Association. Reports are consumed by stakeholders including chief information officers at JPMorgan Chase, chief privacy officers at Facebook, Inc., and contracting officers in procurement processes at Department of Defense. While the AICPA issues guidance, regulatory recognition varies; agencies like the Office of the Comptroller of the Currency or Federal Trade Commission may reference such attestations during examinations or enforcement actions.

Relation to Other Frameworks

The Trust Services Criteria intersect with, but remain distinct from, frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework, HIPAA Security Rule, and PCI DSS. Mapping documents and crosswalks are produced by organizations including ISACA and the AICPA to facilitate alignment with COBIT and governance models promulgated by COSO. Industry-specific standards—used in sectors represented by firms like Pfizer or ExxonMobil—may require additional controls beyond the criteria. International bodies such as the International Federation of Accountants influence harmonization efforts, while multinational corporations coordinate compliance with regional regulators such as the European Data Protection Board and national agencies like the UK Information Commissioner's Office.

Criticisms and Limitations

Critiques of the Trust Services Criteria mirror debates about attestations generally: dependence on auditor judgment, potential for scope limitation by service organizations, and variability in report usefulness for risk-based decision-making. Commentators from academia and think tanks such as Brookings Institution and legal analyses by firms like Skadden, Arps, Slate, Meagher & Flom note that attestations do not guarantee absence of incidents—illustrated by breaches at Equifax and outages at AWS—and can create a false sense of security. Small and medium enterprises represented by trade groups like National Small Business Association may find the cost burdensome, while multinational legal regimes like the European Union impose privacy obligations that require supplementary controls. Ongoing standard-setting discussions involve participants from AICPA, ISACA, and regulators who debate enhancements to assurance models, transparency, and harmonization with international standards.

Category:Information security standards