SOC 2® criteria study tool
Unofficial plain-English study tool. Not affiliated with or endorsed by the AICPA. Read the AICPA’s own criteria
Learn what the SOC 2 criteria numbers are about, in plain English. Browse a map of the criteria, drill the ones you keep missing, and pick up where you left off. It’s free, with no account: your progress stays in your browser.
Start with the numbers
A customer’s questionnaire, an auditor’s request list, and a policy’s inline references all cite criteria by number. This tool teaches what the numbers are about, in our own plain-English words, and drills you until you can place one without looking.
How to read a criterion number
A criterion number such as CC6.1 has three parts. The letters name the group: CC for the common criteria, and A, C, PI, and P for the four optional categories. The number after the letters is the series within that group. The number after the dot is the criterion within the series.
So CC6.1 is the first criterion in series 6 of the common criteria, and P4.2 is the second in series 4 of privacy. A customer’s mapping, an auditor’s request list, and a policy’s inline references all use these numbers, which is why this guide keeps them as tags.
The five categories
CCThe base33 in this tool
Security
Whether your protections hold up against misuse and damage. Its criteria are numbered CC1 to CC9 (the “common criteria”), and the other four categories build on them.
AOptional3 in this tool
Availability
Whether your service is up and usable the way you have promised, and whether you can recover when it isn’t.
COptional2 in this tool
Confidentiality
Whether information you have agreed to keep private stays private, and is destroyed when its time is up.
PIOptional5 in this tool
Processing integrity
Whether the system does its job correctly: the right results, nothing dropped or duplicated, nothing run without approval.
POptional18 in this tool
Privacy
Whether personal information is handled the way you told people it would be.
How the drills work
- Recall
- You see a number. Say what it is about, then reveal our label and summary and grade yourself.
- Identify
- You read our summary and pick its number from four, all from the same neighborhood.
- Practice
- You read one of our examples of what a small team might do and pick the number it belongs to.
Each card sits in a box from 0 to 4. A right answer moves it up one box, and a miss sends it back two, so the ones you miss come around more often and the ones you know fade out. From box 3 a card counts as known. Your progress stays in this browser; there are no accounts.
Every sheet and drill card has a Listen button. It reads our text in a computer-generated voice, not a person. The first time you press one, it starts with a short spoken note that this tool is unofficial and not affiliated with the AICPA. The reading speed you pick stays in this browser too.
The criteria map
Each row is one criterion number with our label for it. Tap a row for the summary, some examples, and a link to its page in the guide.
0 known0 learning61 not started
- not started
- learning
- known
Security
0 of 33 known
Series CC1
Series CC2
Series CC3
Series CC4
Series CC5
Series CC6
Series CC7
Series CC8
Series CC9
Availability
0 of 3 known
Series A1
Confidentiality
0 of 2 known
Series C1
Processing integrity
0 of 5 known
Series PI1
Privacy
0 of 18 known
Series P1
Series P2
Series P3
Series P4
Series P5
Series P6
Series P7
Series P8
Your progress
0 known0 learning61 not started
No answers yet. Start a drill and your progress will show here.
By category
Security0 of 33 known
Availability0 of 3 known
Confidentiality0 of 2 known
Processing integrity0 of 5 known
Privacy0 of 18 known
Worth another look
Nothing yet. Criteria you miss in the drills will show up here.
Where it is kept
Your progress is saved in this browser only. We don’t have accounts and never see it, so a different browser or device starts fresh, and clearing the site’s data erases it.
Keep going
- Read the guideSOC 2 Trust Services Criteria: an unofficial plain-English guideThe five categories, where a small team starts, and a page for each topic.
- Not sure you need it?Do you need SOC 2 yet? What to send before you have a reportWhat to send customers while you don’t have a report.
- Start with the paperworkThe first five security policies a startup needs before SOC 2The first five policies a startup writes.
About this guide and the study tool
Who we are, and aren’t
Blank Slate Creative, LLC is not affiliated with, endorsed by, or sponsored by the AICPA, CIMA, or the Association of International Certified Professional Accountants. We are not a CPA firm. Only a licensed CPA firm can perform a SOC 2 examination and issue a report.
What this is, and isn’t
This is an unofficial, plain-English explanation written by Blank Slate Creative, LLC. It is not the Trust Services Criteria, and it does not reproduce or replace them.
It is not legal, audit, or attestation advice.
Using this guide or the study tool does not mean you will pass an audit or satisfy any customer or auditor.
The “in practice” notes and examples are our own views, not requirements of the standard.
Written about the 2017 criteria with the 2022 revised points of focus. The AICPA may revise them.
Read the AICPA’s own publication for the authoritative wording. The PDF download asks for a free AICPA account.
Trademarks
AICPA and American Institute of CPAs are trademarks of the American Institute of Certified Public Accountants and are registered in the US, the EU and other countries.
SOC 1®, SOC 2® and SOC 3® trademarks are registered trademarks of the AICPA.