SOC 2 Trust Services Criteria points of focus revised in 2022
In October 2022, the American Institute of Certified Public Accountants (AICPA) issued revised points of focus for the 2017 Trust Services Criteria (TSC) that SOC 2 examinations use. The five categories (security, availability, processing integrity, confidentiality, and privacy) and the criteria themselves did not change. The points of focus, which illustrate what auditors consider under each criterion, were updated for current technology, privacy, and data management practice.
This item was added to the change feed at launch so followers can see the kind of criteria update a SOC 2 subscription covers. It is not a new announcement.
What changed
Points of focus are guidance, not a second control list. Examiners and service organizations use them to interpret the criteria. The 2022 revision aligned those illustrations with how systems are actually run now (cloud, privacy programs, data management) without creating new categories or making Security optional.
SOC 2 remains an attestation examination by a licensed CPA firm, not a certification. Type 1 still covers design at a point in time. Type 2 still tests operating effectiveness over a review period.
What did not change
Customers still decide which report type and which categories they will accept. Auditor independence rules still forbid the firm that designed your controls from issuing the opinion. A report is still a restricted-use document for a defined system and period, not a permanent badge.
What to do now
- If a customer asked for “SOC 2,” confirm type, categories, and how recent the report must be, in writing, with their security or vendor-risk team.
- Ask your CPA firm which TSC version and points of focus they are examining against for the current period.
- See SOC 2 Type 1 versus Type 2 if you have not settled the report type.
- Read the SOC 2 page for scope, process, and cost.
- Follow SOC 2 on this site for later AICPA criteria and program updates.