The Proposed 2027 SOC 2 Trust Services Criteria: What Changes and What to Do Now

The 2027 SOC 2 Trust Services Criteria are a proposed update to the criteria CPA firms use to evaluate controls in SOC 2 examinations. The AICPA released the exposure draft in late October 2026, with comments due January 15, 2027. If approved, the new criteria would apply to engagements beginning on or after December 31, 2027. Until then, every SOC 2 report continues to use the 2017 Trust Services Criteria with revised points of focus from 2022.

The proposal is the most significant restructuring of the SOC 2 criteria since 2017. It consolidates and renumbers the common criteria, moves business continuity planning under Availability, expands vendor management, and adds points of focus for artificial intelligence. This guide explains what is proposed, what remains uncertain, and the decisions you should make now rather than in late 2027.

What is the 2027 SOC 2 Trust Services Criteria exposure draft?

The 2027 SOC 2 Trust Services Criteria exposure draft is a proposed revision to TSP Section 100, issued by the AICPA's Assurance Services Executive Committee (ASEC) for public comment. The AICPA describes it as a significant modernization of the framework used by CPAs to evaluate controls over information systems (AICPA & CIMA).

Key facts:

• Who issued it: ASEC, through the AICPA's SOC 2 Working Group.
• When: The AICPA download page is dated October 26, 2026, and the press release October 28, 2026.
• What it covers: The download page lists exposure drafts of both the proposed Trust Services Criteria and the Description Criteria (DC Section 200) used in SOC 2 examinations (AICPA & CIMA download page).
• Comment deadline: January 15, 2027.
• Proposed effective date: Engagements beginning on or after December 31, 2027, with early adoption permitted (Journal of Accountancy).

The AICPA states that the revisions are intended to improve the clarity and usability of SOC 2 reports, and that the draft incorporates expanded considerations for AI and other emerging technologies.

An exposure draft is exactly that: a draft. The final criteria may differ, sometimes substantially, after the AICPA considers comments. Everything below describes the proposal as released.

When would the 2027 criteria take effect?

The 2027 criteria would take effect for SOC 2 engagements beginning on or after December 31, 2027, if the AICPA approves them. Early adoption would be permitted, so some reports could use the new criteria before that date.

One practical question the draft does not settle is how "engagements beginning on or after" applies to the different dates in a SOC 2 examination. A Type 2 engagement has an engagement letter date, an observation period start date, a period end date, and a report date. One practitioner analysis recommends asking your CPA firm how the effective date applies to Type 2 observation periods, Type 1 report dates, and issue dates (SOC2Auditors.org). That is the right question to raise now, because a twelve-month Type 2 period starting in mid-2027 would straddle the effective date.

How many criteria are in the proposed 2027 SOC 2 Trust Services Criteria?

Based on one published reading of the redline, the proposed 2027 SOC 2 Trust Services Criteria contain 50 criteria, down from 61 in the 2017 version. The reduction comes almost entirely from the common criteria, which make up the Security category and apply to every SOC 2 examination.

Source: SOC2Auditors.org analysis of the exposure draft. This is a third-party reading of the redline, not an AICPA crosswalk. Confirm against the AICPA's own documents before relying on specific numbers.

Fewer criteria does not mean fewer controls. Criteria describe what must be achieved. Your controls are how you achieve it. Most organizations will find that their existing controls still address the consolidated criteria, but the mapping between the two will change.

How would the common criteria be renumbered?

The common criteria would be reorganized from nine series (CC1 to CC9) into eight series (CC1 to CC8). The first four series keep their themes but shrink. The control activities series (2017 CC5) would be removed as a separate series, and the remaining series would shift numbers.

Source: SOC2Auditors.org, described there as its own reading of the redline.

The consequence that matters most in practice is the number collision. Under the draft, "CC6" would mean system operations rather than logical access, and "CC8" would mean vendor management rather than change management. Every questionnaire, control matrix, compliance platform mapping, and policy that cites 2017 numbers would be ambiguous during the transition.

What happens to CC6, CC7, and CC8 in the proposed criteria?

Under the draft, today's CC6, CC7, and CC8 content would be redistributed across new series rather than deleted:

Logical and physical access (2017 CC6, proposed CC5). The eight 2017 criteria would be spread across six. According to the same analysis, 2017 CC6.1 maps mainly to proposed CC5.1, with asset inventory moving to CC5.3, network boundaries to CC5.4, and encryption to CC5.5. Physical access (2017 CC6.4) would become CC5.2, and malicious software (2017 CC6.8) would be split between CC5.3 and CC5.6.

System operations (2017 CC7, proposed CC6). Monitoring for anomalies (2017 CC7.2) would move to CC6.1, and incident response and recovery (2017 CC7.4 and CC7.5) would combine into CC6.2. Vulnerability and configuration detection (2017 CC7.1) would move into the asset protection series at CC5.6 and CC5.3.

Change management (2017 CC8, proposed CC7). The single 2017 criterion, CC8.1, would become three: CC7.1 for infrastructure, CC7.2 for acquired software, and CC7.3 for internally developed software.

The change management split is worth attention. Many SaaS companies treat "change management" as one pull request workflow. Separate criteria for infrastructure, acquired software, and internally developed software would push teams to show how changes to third-party software and infrastructure as code are controlled, not only application code.

What happens to CC9 and business continuity planning?

Under the draft, the 2017 CC9.1 criterion on business disruption risk would have no common-criteria counterpart. Its planning point would move to A1.3 under Availability, and its insurance point would be dropped. The 2017 CC9.2 vendor risk criterion would become the new CC8.1.

This has a scoping consequence that is easy to miss. Today, a Security-only SOC 2 report addresses business disruption risk through CC9.1. If the draft is finalized as written, business continuity planning would sit under Availability, which is an optional category. A company that makes uptime or continuity commitments to customers but scopes its report to Security only may find those commitments less visibly covered. Consider whether Availability belongs in your scope before the transition, not after.

The new CC8.1 vendor management criterion would also carry new points of focus, including "Assesses Subservice Organization" and "Evaluation of Third-Party Components," which the analysis notes covers AI models, APIs, and plugins. If your product depends on third-party AI models, our guide to carve-out vs. inclusive method explains how those providers are treated today.

What AI content is in the proposed SOC 2 criteria?

The proposed 2027 SOC 2 Trust Services Criteria add AI-related points of focus but no AI-specific criterion. According to one analysis of the draft, AI wording appears in points of focus under 17 of the 50 criteria, and points of focus are not individually required.

The AICPA's own release lists the AI themes as AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management, and risks of automated decision-making. The analysis places them across the criteria as follows:

Several of these apply only when AI is in scope. The same analysis notes that the draft does not cover how a SOC 2 report should describe AI in the system description.

None of this is a reason to wait. Points of focus describe what auditors and buyers will increasingly expect to see. The controls behind them, such as unique identities for agents, controlled prompt changes, and monitoring of model behavior, map to today's criteria as well. Our guide to SOC 2 for AI agents covers those controls under the 2017 numbering.

What other changes are in the 2027 draft?

Beyond renumbering and AI, the published analysis identifies several other changes worth knowing:

• COSO references removed. The 2017 criteria were built to align with the COSO 2013 internal control framework. The draft does not mention COSO.
• Governance terminology. "Those charged with governance" replaces "board of directors," which better fits private companies without a formal board.
• Short titles. Most criteria gain short titles, which should make reports and mappings easier to read.
• Dropped points of focus. Several 2017 points are not carried over, including some on oversight, incentives, security awareness training, and external communication.
• Privacy renumbering. P3.2 becomes P2.2, and P3 keeps only P3.1.

A dropped point of focus is not permission to drop a control. Security awareness training, for example, remains a strong control for many risks and a common buyer expectation. Points of focus are illustrations of how a criterion may be met. Whether you still need a control depends on your risk assessment and commitments.

What should you do about the 2027 criteria now?

You should prepare your mappings, scope, and timing decisions now, but keep operating against the 2017 criteria until a final version exists and your auditor confirms when it will use it. A practical sequence:

1. Keep your 2017 numbering. Add a column to your control matrix for the proposed 2027 numbering rather than replacing anything. You will need both during the transition.
2. Ask your CPA firm three questions. Will the firm early adopt? How does the effective date apply to your Type 2 period? Will the firm provide a crosswalk once the criteria are final?
3. Check your period timing. If your next Type 2 period starts in the second half of 2027, it may straddle the effective date. Decide the period with your auditor early.
4. Review a Security-only scope. If you make continuity or uptime commitments, consider adding Availability, since business disruption planning moves there under the draft.
5. Inventory AI. List AI in your product, in staff tools, and in your supply chain. Unsanctioned AI tools and third-party AI models are both called out in the draft's points of focus.
6. Update customer-facing language. Trust center pages and questionnaire answers that cite "CC6.1" will be ambiguous. Start citing the criterion title as well as the number.
7. Check vendor reports. When you review a vendor's SOC 2 report in 2027 and 2028, confirm which version of the criteria it was examined against.
8. Comment if you have a view. Comments go to the AICPA by January 15, 2027.

How should you update a control matrix for the 2027 draft?

Update a control matrix for the 2027 draft by adding columns, not by replacing anything. Your 2017 mapping supports every report until the new criteria are final and adopted, so it must stay intact. The new columns let you see the impact early and make the eventual switch a lookup rather than a project.

An illustrative layout, using the draft mapping described above:

Three habits make this useful. Label the draft column clearly as draft so nobody cites it to a customer as current. Record a change note for any control whose criterion moves to an optional category, such as business continuity moving to Availability. And when the final criteria are published, replace the draft column rather than adding a third, so the matrix never shows two versions of "2027."

Should you early adopt the 2027 SOC 2 criteria?

Early adoption is a joint decision with your CPA firm, and most organizations will not need to make it until the criteria are final. The trade-offs look like this:

The one thing not to do is design controls against the exposure draft's wording as if it were final. Build controls that address the underlying risks, map them to the 2017 criteria for today's report, and re-map once the final criteria are published.

What does this mean for buyers reviewing SOC 2 reports?

For buyers, the transition means SOC 2 reports from different vendors will reference different versions of the criteria for a period of time, and the same criterion number can mean different things. A vendor risk questionnaire that asks "Do you meet CC6.1?" will need to specify which version.

During the transition, reviewers should:

• Confirm which version of the Trust Services Criteria the report was examined against, which is stated in the auditor's report and management's assertion.
• Map findings by topic, such as access, change management, or vendor management, rather than by number.
• Look for AI-related controls in reports from vendors whose products use AI, regardless of the criteria version.

Our guide on how to verify a SOC 2 report covers the rest of the buyer review.

Get a re-mapping gap check before 2027

The cleanest transition starts with knowing exactly how your current controls map to the proposed structure and where gaps would appear. Ledger Audits' Gap Sprint is a fixed-scope readiness assessment that delivers a control matrix, an evidence requirements map, and a prioritized remediation roadmap, typically in two to four weeks. For teams planning their 2027 periods, it can include a side-by-side mapping against both the 2017 criteria and the proposed 2027 structure. Ledger Audits does not issue SOC 2 reports, which keeps readiness work separate from your CPA firm's examination. Book a Gap Sprint call.

Related reading

• SOC 2 for AI Agents and LLM Features
• How to Vet a SOC 2 Audit Firm Before You Sign
• DC Section 200: How to Write a SOC 2 System Description

Frequently asked questions

Have the SOC 2 Trust Services Criteria been updated?

Not yet. The AICPA released an exposure draft of proposed 2027 SOC 2 Trust Services Criteria in October 2026, with comments due January 15, 2027. Until the criteria are finalized and effective, SOC 2 examinations use the 2017 Trust Services Criteria with revised points of focus from 2022.

When do the 2027 SOC 2 Trust Services Criteria take effect?

If approved, the 2027 SOC 2 Trust Services Criteria would apply to engagements beginning on or after December 31, 2027, with early adoption permitted. Ask your CPA firm how the effective date applies to your Type 2 observation period.

How many criteria are in the 2027 SOC 2 draft?

One published analysis of the redline counts 50 criteria in the proposed 2027 SOC 2 Trust Services Criteria, compared with 61 in the 2017 version. The common criteria would fall from 33 to 20 and be renumbered CC1 to CC8. Confirm specific numbers against the AICPA's documents.

Does the 2027 SOC 2 draft add AI requirements?

The draft adds AI-related points of focus but no AI-specific criterion. The AI themes include AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management, and risks of automated decision-making. Points of focus are not individually required.

Do I need to change my SOC 2 controls for 2027?

Most organizations will not need to replace controls, but they will need to re-map them to the new criteria numbering once the criteria are final. Review AI-related controls, change management for infrastructure and acquired software, vendor management, and whether business continuity commitments require the Availability category.

What happens to CC9.1 in the 2027 draft?

Under the draft as analyzed, the 2017 CC9.1 business disruption criterion has no common-criteria counterpart. Its planning point moves to A1.3 under Availability, and its insurance point is dropped. The 2017 CC9.2 vendor risk criterion becomes CC8.1.

Should we early adopt the 2027 Trust Services Criteria?

Early adoption is a decision to make with your CPA firm once the criteria are final. It may help AI vendors signal a current framework, but it changes year-over-year comparability and depends on your auditor's methodology readiness. Do not design controls against exposure draft wording as if it were final.

Will SOC 2 reports issued in 2027 use the new criteria?

Most SOC 2 reports issued in 2027 will use the 2017 criteria, because the proposed effective date is for engagements beginning on or after December 31, 2027. Some reports may use the new criteria earlier if the final version permits early adoption and the service organization and auditor choose it.