Sonia Notes

AICPA revises guidance on applying
its Trust Services Criteria and SOC 2

Key considerations

Revisions to the Trust Services Criteria guidance
While the AICPA didn’t change the criteria in the TSC, it added new points of focus and clarified
existing points of focus that address the evaluation of whether controls are suitably designed
and operating effectively to achieve the entity’s service commitments and system requirements.
The AICPA said the revised points of focus are intended “to better support application of the
criteria” in an environment of ever-changing threats and vulnerabilities; new technologies;
legal, regulatory and cultural expectations regarding privacy; and changing expectations
regarding data management and confidentiality. The revisions also provide guidance on topics
that entities have struggled with, such as which privacy points of focus apply to data controllers
and which ones apply to data processors.
Service organizations should consider whether and how their controls address the clarifications
and new points of focus. In evaluating the new guidance, organizations should pay particular
attention to the following changes:

• Types of relevant information — New points of focus clarify that the types of information
relevant to systems of internal control include information about data flow, asset
inventory and location, information classification, and the completeness and accuracy of
information used in the system.

• Risk assessment — The revised points of focus on risk assessment provide users with a
more granular approach to evaluating risks by understanding the underlying components
of risk assessment: threat and vulnerability identification and the evaluation of the
likelihood and magnitude of a threat event intersecting with a vulnerability. The revised
points of focus also include the consideration of residual risk after considering internal
controls and management’s decisions to accept, reduce or share risks.

• Monitoring activities — The revised points of focus encourage service organizations to
consider activities performed by the first and second lines of defense (i.e., monitoring
performed by the people who perform a function and monitoring performed by managers
who oversee them, respectively) in addition to internal audit functions and other recurring
information technology (IT) assessments many service organizations have historically
identified in their SOC 2 reports.

• Logical access — Modified points of focus encourage consideration of logical access controls
across the system architecture, including all relevant infrastructure, IT tools, and types of
access, such as employee, contractor, vendor, business partner, system and service accounts.
In addition, recovery of devices, such as laptops, is now considered in the points of focus.
2 | To the Point AICPA revises guidance on applying its Trust Services Criteria and SOC 2 Description Criteria 2 November 2022

• Change management — Two new points of focus have been added to address change
management. The first relates to the identification, testing and implementation of
software patches. The second addresses the consideration of resilience requirements
during the change management process if a SOC 2 report addresses system availability.

• Availability — Given the increase in ransomware attacks, a new point of focus was added on
management’s identification of threats to data recoverability and mitigation procedures.

• Privacy — A number of points of focus were revised to better align with widely used
privacy practices.
The AICPA also emphasized that the applicability of any particular point of focus depends on
the facts and circumstances and that the points of focus provided are unlikely to be exhaustive
for most service organizations. Consequently, use of the TSC does not require that every
point of focus be met. However, a service organization should consider the applicability of the
new points of focus and whether other points of focus also need to be met to achieve their
service commitments and system requirements.

122 viewsSony, edited 15:28