The first thing to understand about a "SOC 2 controls list" is that there isn't an official one. SOC 2 is built on the AICPA's Trust Services Criteria, and the criteria describe what must be true — access is restricted, changes are reviewed, incidents are handled — not the exact control you use to make it true. Your auditor doesn't grade you against a government checklist; they judge whether the controls you designed genuinely satisfy each criterion. That's why two SaaS companies can pass the same SOC 2 with very different control sets. What every report shares is the structure below: the nine Common Criteria families (CC1–CC9) that make up the mandatory Security category, plus any of the four optional categories you add.
This page gives you that structure as a working reference. For each Common Criteria family you'll get what it covers, the controls a typical SaaS team uses to satisfy it, and the evidence an auditor will ask for. Treat it as the map you build your own control set from — then turn it into documents and evidence with a policy template set and a readiness checklist.
The nine Common Criteria control families (2026)
Every SOC 2 report covers all nine families below — they are the Security category, the only mandatory part of SOC 2. CC1–CC5 come from the COSO internal-control framework and lean toward governance; CC6–CC9 are the technical and operational families where auditors gather the most evidence. Use the filter to jump between governance and technical families.
| Family | What it covers | Typical controls a SaaS team uses | Key evidence |
|---|---|---|---|
| CC1 Control Environment | Tone at the top: org structure, ethics, board oversight, HR security | Org chart, code of conduct, background checks, security-responsibility assignment | Signed policies, hire/offboard records, org chart |
| CC2 Communication & Information | Internal and external communication of security responsibilities | Published policies, security training, customer-facing security docs | Training completion logs, policy acknowledgements |
| CC3 Risk Assessment | Identifying, analyzing and rating risks to objectives | Annual risk assessment, risk register, fraud-risk consideration | Dated risk assessment, risk register with owners |
| CC4 Monitoring Activities | Evaluating whether controls are present and working | Internal control reviews, vendor monitoring, management review cadence | Review meeting notes, remediation tracking |
| CC5 Control Activities | Selecting and developing controls and the tech that supports them | Control matrix, segregation of duties, policy-to-control mapping | Control mapping document, SoD evidence |
| CC6 Logical & Physical Access | Restricting access to systems, data and facilities | SSO + MFA, least-privilege roles, quarterly access reviews, encryption, 24-hour deprovisioning | Access-review records, MFA config, deprovisioning tickets |
| CC7 System Operations | Detecting and responding to security events | Centralized logging, alerting, vulnerability scanning, incident-response plan | Alert logs, scan reports, incident tickets & post-mortems |
| CC8 Change Management | Authorizing, testing and approving system changes | Pull-request reviews, CI/CD gates, change approvals, separate environments | PR history, deployment logs, change tickets |
| CC9 Risk Mitigation | Mitigating risk from disruptions and vendors | Business-continuity plan, vendor risk reviews, insurance, backups | BCP/DR test results, vendor assessments, backup logs |
There is no official per-control count: the Security category defines 33 points of focus across these nine families, and most SaaS teams implement 60–120 discrete controls to satisfy them, depending on environment and scope.
The four optional Trust Services categories
Beyond Security, SOC 2 has four additional categories you add only when a contract or your service commitments require them. Each adds its own controls and evidence on top of the Common Criteria. Most first-time companies skip all four and scope to Security only.
| Category | Code | What it adds | When you actually need it |
|---|---|---|---|
| Availability | A1 | Capacity planning, backups, disaster recovery and uptime monitoring | You sign SLAs / customers depend on uptime |
| Confidentiality | C1 | Identifying confidential data and protecting/disposing of it | You handle customer data marked confidential (NDAs, IP) |
| Processing Integrity | PI1 | Processing is complete, valid, accurate, timely and authorized | You run transactions, billing or data pipelines customers rely on |
| Privacy | P1–P8 | Notice, choice, collection, use, retention and disposal of personal data | You collect personal information and make privacy commitments |
Adding a category is rarely free: Availability alone can pull in formal DR testing and capacity evidence, and Privacy is effectively its own mini-framework with eight criteria. Add a category when a buyer's contract names it — not preemptively. If you're unsure where you'll land overall, the cost breakdown shows how scope drives the price and the timeline guide shows how it drives the schedule.
SOC 2 Audit Prep Kit for SaaS Founders
A controls list only helps if it becomes written policies and organized evidence. The audit-prep kit maps every Common Criteria family above to the documents and evidence auditors expect — the full policy set, a Trust Services Criteria control matrix, and an evidence checklist per control — so you can go from "I understand the families" to "I'm ready for fieldwork" without a $10,000–$15,000 consultant gap assessment.
- 14 core security policy templates mapped to CC1–CC9
- Trust Services Criteria control matrix (criteria → control → evidence)
- Evidence-collection checklist per control family
- Access-review & vendor-risk trackers (CC6 / CC9)
- Incident-response & change-management runbooks (CC7 / CC8)
- Auditor-question prep prompts
SOC2Guide sells this digital product directly. It's a documentation accelerator, not legal or audit advice — your CPA firm issues the actual report. One-time purchase, instant download, free updates.
How to choose which controls apply to you
The criteria are fixed, but your control set is a series of decisions. These are the factors that decide which specific controls you implement — and where teams most often over- or under-scope.
1. Your scope: Security only, or more categories?
This is the single biggest driver. Security only (the nine Common Criteria) is what the vast majority of SaaS buyers ask for. Every optional category you add — Availability, Confidentiality, Processing Integrity, Privacy — multiplies controls and evidence. Let real customer contracts decide; adding criteria "to be safe" is the most common way early teams overspend and overrun their timeline.
2. Your architecture and stack
The right controls for CC6 and CC7 depend on what you run. A single-cloud, SSO-everywhere startup satisfies access control with one identity provider and MFA; a company with legacy systems, multiple clouds and on-prem hardware needs far more access and monitoring controls to cover the same criteria. Map controls to the systems you actually have, not to a generic template that assumes infrastructure you don't run.
3. Type I vs Type II
The control families are identical, but a Type II requires each control to operate across a 3–12 month window, so recurring controls (access reviews, scans, change approvals) must be running and evidenced for months. A Type I only tests design at a point in time. If you're early, design every control now even for a Type I so the operating history is already accumulating when you move to Type II.
4. Where automation earns its place
CC6, CC7 and CC8 generate continuous evidence — access reviews, vulnerability scans, alert handling, tracked changes — and that's exactly where a compliance automation platform saves the most engineering time. Governance families (CC1–CC5) are mostly documents you write once and review annually; they rarely justify tooling on their own. Decide on automation per family, based on how often the evidence repeats.
5. Segregation of duties and team size
CC5 expects some separation between who builds, who approves and who has production access. Very small teams can't fully separate every duty, and auditors know that — the answer is compensating controls (peer review, logged approvals, monitoring) documented explicitly, not pretending a four-person team has enterprise role separation. Right-size the control to your headcount and write down why it's adequate.
Tools that automate the high-evidence control families
If you decide automation earns its place for the CC6–CC8 families, the three market leaders ship pre-built control libraries mapped to the Trust Services Criteria and collect the recurring evidence for you. They differ on onboarding, framework breadth and price; all run startup tiers and partner programs, with quote-based pricing that scales with headcount.
Most useful for the access, monitoring and change-management families (CC6–CC8) where evidence repeats. Governance families are mostly documents you can handle from a template set.
Some links on this page are affiliate or partner links and we may earn a commission if you sign up, at no extra cost to you. We only list tools we consider genuinely useful, and these links never change our pricing or recommendations.
Read the full Vanta vs Drata vs Secureframe comparison → — control libraries, integrations, frameworks and audit support side by side, with an interactive picker.
Keep going
What is SOC 2?
Type I vs Type II, the five categories, and which report you actually need.
SOC 2 readiness checklist
Turn these control families into a step-by-step path to audit-ready, with a free interactive checklist.
SOC 2 policy templates
The 14 documents that back the controls above, mapped to the Common Criteria.
SOC 2 cost breakdown
How scope and control count drive your year-one budget, with a free estimator.
SOC 2 timeline
How long implementing and operating these controls actually takes.
Vanta vs Drata vs Secureframe
Which platform automates the CC6–CC8 evidence best for your team.
Map your controls, then prove them
You have the families. Grab the audit-prep kit to turn them into policies, a control matrix and evidence checklists — without a consultant.
Get the audit-prep kitFrequently asked questions
How many controls are in SOC 2?
There's no single fixed number. SOC 2 is built on the Trust Services Criteria, and the Security category alone — the Common Criteria, CC1–CC9 — contains 33 points of focus across nine families. Most companies implement 60–120 discrete controls to satisfy them, because each criterion is met by several controls in practice. The exact count depends on your scope, environment and which optional categories you add. The criteria are mandatory; the controls are yours to design and your auditor validates.
What are the nine SOC 2 Common Criteria?
CC1 Control Environment, CC2 Communication & Information, CC3 Risk Assessment, CC4 Monitoring Activities, CC5 Control Activities, CC6 Logical & Physical Access, CC7 System Operations, CC8 Change Management, and CC9 Risk Mitigation. CC1–CC5 map to the COSO framework; CC6–CC9 are the technical families auditors test most. Every SOC 2 report covers all nine because together they are the mandatory Security category.
Are all five Trust Services Criteria required?
No — only Security (the Common Criteria) is mandatory in every report. Availability, Confidentiality, Processing Integrity and Privacy are optional and added only when a contract or your service commitments require them. Most first-time SaaS companies scope to Security only because that's what buyers ask for, then add categories later. Each added category adds controls, evidence and audit hours, so scope deliberately.
What's the difference between a criterion and a control?
A criterion is the AICPA requirement (e.g. CC6.1: restrict logical access). A control is the specific safeguard you implement to meet it (SSO + MFA, quarterly access reviews, 24-hour deprovisioning). The criteria are identical for every company; the controls are yours to design around your stack. The auditor tests whether your controls satisfy each criterion — and for a Type II, whether they operated consistently over the window.
Which control families do auditors scrutinize most?
CC6 (access), CC7 (system operations — logging, monitoring, incident response) and CC8 (change management). These require recurring evidence rather than a one-time document, so they're where most exceptions appear. Teams that automate evidence in these three families usually clear the audit with the fewest findings.
Do I need a policy for every control?
Not one policy per control, but every control area needs documented policy backing plus evidence that the policy is followed. A complete set of ~14 core security policies covers the documentation side of all nine Common Criteria families; the controls are then evidenced through configurations, logs, tickets and reviews. Auditors want both the written policy and proof it operates.