How adding a trust services category to your SOC 2 changes the work
Suppose a customer's security questionnaire now asks for a SOC 2 that covers availability, or a bank wants privacy included. Every SOC 2 already covers the security common criteria CC1.1 to CC9.2, which is 33 criteria. Availability (A1, 3 criteria), confidentiality (C1, 2 criteria), processing integrity (PI1, 5 criteria) and privacy (P1 to P8, 18 criteria) each add criteria only when that category is in scope. The question is not how many criteria exist, but how many of them your systems actually touch and how much of the evidence you already hold.
The effort depends on three things: the category, the systems it reaches and whether the evidence exists. Privacy has the widest reach. When it is in scope, nine common criteria (CC1.3, CC1.5, CC2.2, CC2.3, CC6.1, CC7.3, CC7.4, CC8.1 and CC9.2) carry additional points of focus, so access, change and monitoring records must show privacy considerations too. Availability asks you to show capacity monitoring under A1.1 and tested recovery, which may already exist in your infrastructure logs and backup records. Ask your CPA firm and your own engineers which of these records exist today, for which systems and for how long. Gaps there, not the criteria count, usually set the timeline.
Your organization owns its controls and the decisions about scope. DeployOpen can help prepare systems, configuration and evidence for the added criteria, and that work is scoped in writing before it starts. Only the CPA firm can examine the controls and issue the report, and the firm must agree to the expanded scope in its engagement. Confirm that agreement early, because a category added mid-period raises questions about the period the report covers and how the system description is updated.
What adding a category costs and who gets paid
This table splits the cost of adding an availability, confidentiality, processing integrity or privacy category into the parties who are paid for each part, whether the cost is one-time or recurring, and what drives it. Use it to see where the money goes before asking for quotes, and to separate the auditor's fee from your internal and partner work. No prices are stated because none were supplied; the drivers and quote questions are what to compare.
| Cost component | Who is paid | One-time or recurring, and what drives it |
|---|---|---|
| CPA firm added examination work | The CPA firm issuing the report | Recurring each period. Rises with the number of added criteria (A1 3, C1 2, PI1 5, P1 to P8 18) and with the number of samples tested. Ask for the added testing hours by category. |
| Scoping and system description update | The CPA firm and internal staff | One-time at first addition, then recurring as the description changes. Driven by how many services, data flows and subservice organizations the new category touches. |
| Internal design of new criteria | Your staff or salaried time | One-time for policies, notices, retention and processing rules. Driven by how much existing policy can be reused and how many teams own the new commitments. |
| Internal operation and evidence collection | Your staff or salaried time | Recurring across the observation period. Driven by how many new controls need periodic evidence, such as retention reviews, capacity reports or restore tests. |
| Implementation partner work on systems and evidence | The partner, under a written scope such as DeployOpen's fixed-scope engagements | Mostly one-time for configuration, logging, backup and disposal tooling, plus optional recurring retainers for upgrades and testing. Driven by how much infrastructure is already instrumented. |
| Tooling and licences | Tool vendors or open-source maintenance time | Recurring if commercial. Open-source options can lower licence cost but still need hosting and staff time. Ask whether each tool's cost is per user, per system or per data volume. |
| Privacy notice and legal review | Counsel or privacy specialists | One-time for notices and contract changes, with periodic review. Driven by the number of jurisdictions and the sensitivity of the data collected. |
| Quote questions to ask | All parties | Ask each provider to separate fees by category, state which criteria are in scope, list recurring versus one-time items, and name the assumptions behind any sample sizes or evidence volumes. |
Which categories add the most effort
Each added category brings its own criteria, evidence and testing, so the number of criteria is the first signal of effort. Privacy adds the most, but the cards below also show that the work depends on which systems and data each category touches. Read them against your current control matrix before deciding what to include.
Privacy: the largest addition
Privacy adds 18 criteria, P1 to P8, covering notice, choice and consent, collection, use, retention and disposal, access, disclosure and notification, quality, and monitoring and enforcement. When privacy is in scope, nine common criteria also carry extra points of focus, so existing security controls are tested against privacy characteristics too. Check whether your organization already holds a privacy notice, consent records and a retention schedule that the auditor can sample.
Availability: capacity and recovery
Availability adds three criteria. A1.1 asks you to maintain, monitor and evaluate processing capacity and use so you can manage demand and add capacity. The other two cover environmental protections and backup and recovery infrastructure, and testing of the recovery plan. The effort depends on whether capacity data, backup restore tests and recovery exercises already exist as recurring records.
Confidentiality: finding the data
Confidentiality adds two criteria. C1.1 requires you to identify confidential information and maintain it in line with your confidentiality objectives, and a further criterion covers disposing of it when it is no longer needed. The hard part is usually the inventory: you must know which datasets, exports, contracts and backups hold confidential material before any control can be tested. Ask who owns the classification scheme and how disposal is evidenced.
Processing integrity: input to output
Processing integrity adds five criteria, PI1, built around processing specifications and controls over inputs, processing, outputs and storage. The TSC frames them for the provision of services or the production, manufacturing or distribution of goods, so a software company and a logistics firm will scope them differently. Expect the work to center on defined processing specifications, reconciliation or validation checks, and records that show outputs were correct and stored as intended.
Phasing the additions
Adding categories in stages lets you test one set of controls before the next. A common approach is to add the category that customers ask for first, confirm the new evidence is produced during the current period, and then add the next. Confirm with your auditor whether a category added mid-cycle changes the period you can report on, and record the decision in the system description.
What privacy adds to the common criteria
Adding privacy to a SOC 2 brings 18 additional criteria (P1 to P8), and it also adds extra points of focus under nine common criteria that every SOC 2 already tests: CC1.3, CC1.5, CC2.2, CC2.3, CC6.1, CC7.3, CC7.4, CC8.1 and CC9.2, according to the NIST crosswalk to the 2017 Trust Services Criteria. The common criteria work does not change in number, but the design and testing of those controls widen once privacy is in scope. The first step is to map each of the nine criteria to the privacy notice, access, disclosure and retention practices your system actually runs, so you can see which controls need new evidence.
Points of focus are characteristics that help you design and evaluate controls. They are not separate requirements, so you do not have to address every one of them. The decision that matters is which privacy points of focus you address, how you address them, and what you leave out. Record that choice in the system description, because the description is where a reader will look to see how privacy shaped the controls. Ask your auditor early to confirm they agree with the approach, since the description and the testing must match.
Much of this work lands on controls that already operate for security. Access reviews under CC6.1, change management under CC8.1 and incident and monitoring activity under CC7.3 and CC7.4 are often in place, but they may not yet test privacy outcomes such as whether a departed employee's access to personal data was removed or whether a change affected how personal information is collected. Notice and commitments tied to CC2.2 and CC2.3 are where security teams and legal teams most often need to agree on wording. Plan a review with both teams before fieldwork begins, not during it.
How to phase a new category into an existing SOC 2
The sequence moves a category from a business decision to controls that operate and are tested in a later examination period. Each phase produces a document or record that the next phase depends on, so the report can describe the new category accurately when it is issued.
Decide scope and record customer commitments
Leadership decides which added category or categories the report should cover, such as availability or privacy, and why. Sales, legal and customer success list the commitments already made in contracts, order forms and security questionnaires that the category would support. The output is a scope memo signed by the accountable executive, stating the categories in scope, the commitments behind them and the period in which they take effect. The step is done when the memo is approved and the commitments are traceable to specific contract language.
Run a gap assessment against the added criteria
Map each criterion in the added category to the controls you already operate, which often include backup, monitoring, access and data deletion processes built for other reasons. Privacy also brings additional points of focus to nine common criteria, so review CC1.3, CC1.5, CC2.2, CC2.3, CC6.1, CC7.3, CC7.4, CC8.1 and CC9.2 as well. The output is a gap register listing each criterion as covered, partly covered or missing, with an owner for each gap. The step is complete when every added criterion has a status and no criterion is left unassessed.
Update the system description and commitments
Revise the system description to cover the new category, using the description criteria that the AICPA set for management's description. Describe the services, principal service commitments, system requirements, components, and any subservice organizations that now handle relevant data or capacity. Update the commitments and the list of applicable criteria so they match the scope memo. The output is a revised description and draft commitments, reviewed by legal and by the people who operate the system. The step is done when the description and the control matrix use the same scope.
Design and implement the new controls
Write the controls that close each gap, assign an owner and a frequency to each, and define the evidence each control produces. Examples include capacity monitoring and backup restore tests for availability, data classification and disposal rules for confidentiality, or notice, consent and retention workflows for privacy. Engineering usually builds the technical parts, while legal and product own the policy text. The output is an updated control matrix and the policies or procedures that support it. The step is complete when each new control has an owner, a documented procedure and a first execution recorded.
Start evidence collection and let controls operate
Begin collecting evidence from the first day the new controls operate, not when the auditor asks for it. Store tickets, logs, review sign-offs, restore records and approvals in a location with fixed retention, and note any control that failed or needed rework. New controls generally need time to operate before a Type 2 test, so the period in which they run should be long enough to show consistent operation. The output is an evidence set indexed against the control matrix. The step is done when a sample of each control can be traced to a dated record.
Test internally before the examination
Before the CPA firm starts fieldwork, have someone independent of the control owners test each new control against its description and evidence. Confirm that the evidence is complete, the control ran at the stated frequency and exceptions were recorded and resolved. Ask the firm early which evidence it expects for each added criterion, since its tests and sampling set the level of proof. The output is an internal test workpaper and a list of remediation items. The step is complete when remaining gaps are either closed or disclosed to management.
Test the new category in the next examination period
In the examination period that includes the new category, the CPA firm tests the added criteria alongside the common criteria and reports on the operating effectiveness of the full scope. Management provides the written representations that cover the new category and the revised description. Confirm the timing with the firm and the customers who asked for the category, because the report can only speak to controls that were in place during the period it covers. The output is a report whose system description and criteria list include the new category. The step is done when the report is issued and the team has recorded lessons for the next cycle.
Add now, add later or split the report
This option brings the new category into the current examination cycle, so the next period's system description and testing both cover it. It suits a customer deadline that falls inside the period, provided the controls can be designed, deployed and operated for enough time to produce evidence. Because the auditor tests operating effectiveness over the whole period, a control that starts late in the period leaves a short window of evidence, and auditors can only test what happened.
- System description: management adds the category to the description of the system and the applicable criteria, and the description should state when each new control started operating.
- Auditor testing: the additional criteria for the category are tested alongside the 33 common criteria, which increases the sample work and the number of control owners interviewed.
- Evidence window: controls added mid-period produce evidence only from their start date, so confirm with the auditor how a late start will be presented.
- Scheduling risk: the category's controls must be built, assigned and evidenced while the team also runs normal operations, which is the main reason this option stretches a small team.
- Customer fit: check whether the customer will accept a report whose new controls were operating for part of the period.
Before choosing this path, confirm the start date of each new control with the auditor and agree how the report will describe partial-period operation.
This option delays the new category until the next renewal, using the time before that period to design the controls and run a readiness review. It fits organizations with no near-term deadline, or where the new category would otherwise compress the current period's work. The trade-off is that the customer waits for the category, and the first report that includes it will cover a full period of operation only if the controls start at the period's beginning.
- Readiness pass: a gap assessment against the additional criteria identifies missing policies, owners and evidence before the period opens.
- System description: the description for the renewal period adds the category from the first day, so the change is clean and easier to compare with prior reports.
- Auditor testing: the auditor tests the new criteria over the full period, which usually gives a stronger record than a mid-period addition.
- Timing: the gap between now and renewal should be long enough for the controls to run before the period starts, so ask the auditor what pre-period evidence they will accept.
- Cost profile: readiness work is spread across the year rather than concentrated in one period.
Before choosing this path, confirm the renewal start date and whether the customer will accept a report that omits the category until then.
This option keeps the security-only report as it is and handles the new category outside it, either through a separate examination with its own scope or a bridge statement agreed with the customer. It is used when a customer accepts a narrower report for a specific purpose and the organization does not want to change the main report yet. The arrangement depends entirely on the customer's acceptance, and an auditor must confirm whether the two examinations can coexist without confusing readers of either report.
- Two boundaries: each report needs a clearly defined system description, so the auditor must agree which components and services each one covers.
- Duplicated testing: shared controls may be tested twice, which raises fees and the workload on control owners.
- Reader confusion: customers comparing the two reports need a plain explanation of what each one covers and what it excludes.
- Contract language: the customer's agreement should state which report satisfies the requirement, so no one assumes the narrower report covers the category.
- Long-term cost: running two reports usually becomes harder to sustain than moving to one combined report.
Before choosing this path, ask the auditor whether the separate report is in scope for their practice and get the customer's written acceptance of the arrangement.
What delays or inflates a scope expansion
Adding a category rarely fails on the criteria themselves. It stalls when the commitments, the system description, the data inventory, the vendor reviews and the evidence process lag behind the new scope. Each card below names one of these failure points and how to avoid it before the examination window opens.
Commitments and system description not updated
Adding a category changes what the organization promises customers, so the principal service commitments and system requirements must name availability, confidentiality or privacy commitments. The system description must also describe the new components, data flows and responsibilities that support them. Check that the description, the policies and the customer-facing terms all say the same thing before the period starts. A description that still reads as security-only while the control matrix tests A1 or P1 to P8 invites exceptions.
Controls starting too late to operate
A new criterion needs a control that has run long enough to leave evidence. If availability capacity monitoring or privacy retention controls are designed in the final month, the auditor has little operating history to test. Set a date for each new control to go live, assign an owner, and confirm that its first evidence is captured in the normal workflow. Ask your auditor which controls they expect to see operating from the start of the period and which can be designed later.
Unclear data inventory for confidentiality and privacy
Confidentiality and privacy controls depend on knowing which data is confidential or personal, where it is stored, and how long it is kept. C1.1 requires the organization to identify and maintain confidential information in line with its objectives. Without a current inventory that maps data classes to systems, backups and third parties, retention, disposal and access criteria cannot be tested. Build the inventory from the infrastructure, not from memory, and review it on a fixed schedule.
Third-party processors not reviewed for new scope
A new category often brings new subservice organizations, such as a backup provider for availability or a notice or consent tool for privacy. Those parties sit inside the examination boundary whether or not they were reviewed before. Under CC9.2, the organization must manage risks from vendors and business partners. Collect each new provider's SOC report or equivalent assurance, confirm it covers the relevant criteria, and document complementary subservice controls where the provider carries part of the load.
Evidence gathered by hand
When each new criterion depends on screenshots and spreadsheets collected at quarter end, evidence gaps appear and sampling becomes slow. Recovery tests, capacity reports, retention deletions and access reviews are easier to defend when they are generated from the system and stored with dates. Define the evidence for each new criterion before the period starts, automate collection where the platform allows it, and confirm with the auditor that the format and population are acceptable. Automated evidence still needs a human review record.
Questions buyers ask about adding a SOC 2 category
Can we add privacy to our SOC 2 without rebuilding the whole program?
Usually yes, but it is an extension of the existing program, not a light touch. Security is already covered by the common criteria CC1.1 to CC9.2, so the privacy category adds 18 criteria (P1 to P8) on top of them. The Trust Services Criteria also add privacy points of focus to nine common criteria: CC1.3, CC1.5, CC2.2, CC2.3, CC6.1, CC7.3, CC7.4, CC8.1 and CC9.2. Most existing controls can be reused, but each one needs a review of whether its design covers the privacy points of focus. Ask your CPA firm to map the new criteria to your current control matrix before any new work starts, so you can see which controls stay, which change and which are new.
How many extra criteria does availability add to a SOC 2?
Availability adds three criteria, A1.1 to A1.3, to the 33 common criteria that every SOC 2 already covers. A1.1 asks the organization to maintain, monitor and evaluate processing capacity and use of system components so it can manage demand and add capacity. The other two cover environmental protections, backup and recovery infrastructure, and recovery plan testing. The criteria count is small, but the effort depends on whether you already run capacity monitoring, tested restores and recovery exercises. Confirm those three areas with your engineering team before you estimate the work.
Does the next SOC 2 report have to cover the new category?
Not automatically. Categories are included in scope by management's decision, and the system description and report must state which categories are covered. If you add a category, the next report period must test it, because a category in scope needs controls tested over the period. Ask your CPA firm whether a category can be added partway through a period or only at the start of the next one, since that choice affects how the report reads to customers. Be exact in the description about what was in scope for each period so that year-over-year reports can be compared.
What does the work need from our engineering and legal teams?
Engineering owns the technical controls. For availability, that means capacity monitoring, environmental and backup design, and recovery tests. For confidentiality, it means data classification, access restrictions and secure disposal. For privacy, it often means data mapping, retention rules, deletion workflows and changes to how user requests are fulfilled. Legal owns the commitments that the category implies: the privacy notice, consent and disclosure language, and the terms that state what the service promises. Both teams need to agree the wording of commitments before the system description is written, because the auditor tests controls against what the organization has promised.
Can our own team add a category to our SOC 2 in-house?
Yes, if you have people who can design and operate the controls and who understand the criteria. The organization owns its controls, and it can run the project internally. Many teams find it harder to be objective about gaps in their own design, and the auditor still has to test the result independently. An implementation partner such as DeployOpen can prepare systems, controls and evidence inside your own infrastructure, but only an independent CPA firm can examine the controls and issue the report. Decide early which part your team will own, which part you will buy, and what the written scope will cover.
How does adding a category affect our bridge letter and renewal?
A bridge letter covers the gap between the end of one report period and the start of the next, so the category needs to appear in that letter only if it is in scope for the period it covers. If you add a category mid-cycle, tell your customers and CPA firm in writing when the new category takes effect, so the bridge letter does not imply coverage that did not exist. At renewal, the new report must describe the expanded scope and show evidence for the added criteria across the full period. Expect cost and effort to rise at each renewal in proportion to the criteria added, and ask your auditor for a written estimate covering both the first period and later renewals.
How DeployOpen prepares systems and evidence for an expanded scope
DeployOpen starts an expanded scope with a written scope document, agreed before any work begins. For each category being added, that document names the criteria in play, such as A1.1 for availability or the nine common criteria that carry extra points of focus when privacy is included (CC1.3, CC1.5, CC2.2, CC2.3, CC6.1, CC7.3, CC7.4, CC8.1 and CC9.2). It also lists the systems, data stores and self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks that each criterion touches. The client decides which points of focus it will address and why. Ask for that decision to be written down, because the auditor will ask for it.
Where a category needs technical change, DeployOpen implements or adjusts the controls on those platforms and documents each change. Typical work includes capacity monitoring and alerting for availability, data classification and retention settings for confidentiality, and consent, notice and access workflows for privacy. The client owns the control design and the policy decisions behind it. DeployOpen prepares the systems, configuration baselines, and evidence collection so the controls can be tested. Confirm with the implementation partner which configuration exports, logs and tickets will be generated, and where they will be stored.
At handover, DeployOpen provides a record for the auditor: the agreed scope, the control mapping for each added criterion, the evidence index with locations and owners, and the change log for the period. This record supports the client's own control matrix and management's assertion. DeployOpen does not issue audit reports, attestations or certifications, and it does not decide whether a criterion is met. Only an independent CPA firm performs the examination and issues the report. Confirm with the auditor, before work starts, which format of evidence and which period coverage they will accept.
