A SOC 2 controls list is the set of safeguards a company designs and operates to meet the AICPA’s Trust Services Criteria, and the criteria themselves do not prescribe specific controls. Management chooses the controls, the auditor tests them, and the examples below show what is commonly in place for each criteria group.
What is a SOC 2 control?
A SOC 2 control is a policy, procedure or technical safeguard that management puts in place so that a Trust Services Criterion is met. Auditors test the controls you describe, not a list the AICPA hands you.
That distinction matters: two companies can both meet the same criterion with different controls. The criteria set the destination, and your control list is the route. See our Trust Services Criteria guide for the categories and our SOC 2 compliance checklist for preparation tasks.
Which controls fall under the Common Criteria (Security)?
The Common Criteria make up the mandatory Security category and are grouped as CC1 to CC9. CC1 to CC5 follow the principles of COSO’s 2013 Internal Control framework, and CC6 to CC9 add access, operations, change and risk mitigation.
| Group | Example controls | Typical evidence |
|---|---|---|
| CC1 Control Environment | Code of conduct, defined security roles, background screening | Signed acknowledgments, org chart, screening records |
| CC2 Communication and Information | Security policies communicated to staff, customer-facing commitments, incident reporting channel | Policy portal, training logs, published terms |
| CC3 Risk Assessment | Annual risk assessment, risk register, fraud-risk consideration | Risk register, review meeting minutes |
| CC4 Monitoring Activities | Ongoing control monitoring, internal reviews, deficiency tracking | Review records, remediation tickets |
| CC5 Control Activities | Documented policies and procedures that mitigate identified risks | Approved policies with version history |
| CC6 Logical and Physical Access | MFA, least-privilege roles, access reviews, offboarding, encryption, physical access controls | Access review sign-offs, offboarding tickets, configuration screenshots |
| CC7 System Operations | Logging and alerting, vulnerability scanning, incident response plan and testing | Alert records, scan reports, incident tickets |
| CC8 Change Management | Peer review, testing and approval before production release | Pull request approvals, change tickets |
| CC9 Risk Mitigation | Vendor risk assessments, business-disruption planning | Vendor reviews, continuity plan |
These are examples drawn from common practice, not AICPA requirements.
Which controls add Availability, Confidentiality and Processing Integrity?
Each optional category adds a small set of controls tied to its theme, and you include them only when relevant to your service and customer commitments. Healthcare teams should also read SOC 2 and HIPAA.
| Category | Example controls |
|---|---|
| Availability (A1) | Uptime monitoring, capacity planning, backups, tested recovery, disaster recovery plan |
| Confidentiality (C1) | Data classification, encryption of confidential data, retention and secure disposal |
| Processing Integrity (PI1) | Input validation, reconciliation checks, error handling and monitoring of processing |
| Privacy (P1-P8) | Notice, consent, access requests, retention and disposal of personal information |
What evidence do auditors expect for each control?
Auditors expect each control to have three things: a clear description, a named owner and dated evidence that it operated. For a Type II report they sample across the whole observation period.
- Population and samples: the auditor picks examples, such as new hires or production changes, from your records.
- Dated artifacts: tickets, logs, approvals and exports that show who did what and when.
- Consistency: a quarterly review needs to exist for every quarter in the window.
Missing or late evidence is a common source of exceptions; see SOC 2 exceptions and qualified opinions.
How many controls does a SOC 2 report have?
There is no fixed number. A report typically describes dozens of controls, and the count depends on scope, the categories included and how you group similar safeguards. Reports with more criteria or more systems describe more controls.
Keep the list manageable by mapping one control to several criteria, for example encryption supporting Security, Confidentiality and Privacy at once.
Next Assurance helps you design controls that meet the criteria without over-building. See our SOC 2 audit service.
Frequently asked questions about SOC 2 controls
Does the AICPA provide a list of required SOC 2 controls?
No. The AICPA publishes the Trust Services Criteria, which state outcomes your controls must achieve, not the controls themselves. Management designs the controls, describes them in the system description, and the auditor tests them. That is why SOC 2 control lists differ between companies even when they meet the same criteria.
How many controls are in a SOC 2 audit?
There is no fixed number. A report usually describes dozens of controls, and the count depends on the categories included, the systems in scope and how safeguards are grouped. Fewer, well-mapped controls that each satisfy several criteria are easier to operate and evidence than a long list of overlapping ones.
What are the most common SOC 2 controls?
Commonly tested controls include multi-factor authentication, least-privilege access with periodic reviews, timely offboarding, centralized logging and alerting, vulnerability management, encryption, peer-reviewed and approved production changes, incident response procedures, vendor risk assessments, security awareness training and tested backups. These come from common practice, not from AICPA requirements.
What evidence do auditors ask for?
Auditors ask for dated artifacts showing each control operated: access review sign-offs, offboarding tickets, pull request approvals, vulnerability scan reports, incident tickets, training records and signed policies. For a Type II report they sample across the observation period, so evidence must exist for the whole window, not only at the end.
Can one control cover multiple criteria?
Yes, frequently. Encryption at rest and in transit, for example, can support Security, Confidentiality and Privacy at once. Mapping a control to several criteria keeps the control set smaller, as long as your evidence shows it operates for each criterion it is mapped to and the owner understands all of them.
Are SOC 2 controls different for Type I and Type II?
The controls themselves are the same. The difference is what the auditor tests: a Type I checks that controls are suitably designed at one date, while a Type II also tests that they operated effectively over a period, typically 3 to 12 months. Type II therefore demands consistent, dated evidence across the whole window.
Sources
Facts checked against primary sources on October 7, 2026. Control examples reflect common practice; the AICPA criteria do not prescribe specific controls.
- AICPA & CIMA – 2017 Trust Services Criteria (With Revised Points of Focus – 2022): the criteria and categories a SOC 2 examination evaluates.
- AICPA & CIMA – System and Organization Controls: SOC Suite of Services: the AICPA’s overview of SOC 1, SOC 2 and SOC 3 reports.
- AICPA & CIMA – Statement on Standards for Attestation Engagements No. 18: the attestation standard that governs how CPA firms perform SOC examinations.
