2018 SOC 2® Description Criteria (With Revised Implementation Guidance – 2022)

AICPA’s Assurance Services Executive Committee (ASEC), through its Trust Information Integrity Task Force’s SOC 2 Working Group, has developed a set of benchmarks, known as description criteria. These description criteria are to be used when preparing and evaluating the description of the service organization’s system (description) in an examination of a service organization’s controls over security, availability, processing integrity, confidentiality, and privacy (SOC 2 examination). This document presents the description criteria for use in that examination. (The AICPA’s trust services