AICPA proposes improvements to SOC 2 trust services criteria

The AICPA is seeking feedback on proposed updates to the framework used by CPAs to evaluate controls over an organization’s information systems.

The proposed revisions in SOC 2 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy are intended to improve the clarity and usability of SOC 2 reports. SOC 2 examinations are performed by licensed, independent CPAs under AICPA Attestation Standards.

“The way organizations manage and process information and identify risk has changed substantially over the past decade,” Amy Pawlicki, the AICPA’s vice president–Assurance & Advisory Innovation, said in a news release. “These proposed revisions are intended to improve the usability of SOC 2 reports and refine criteria so they can adapt to rapidly evolving technologies.”

The AICPA’s SOC 2 Working Group is seeking public comment on the exposure draft through Jan. 15, 2027. If the updates are approved, they would be effective for engagements beginning on or after Dec. 31, 2027, with early adoption permitted.

According to the news release, the proposed updates are intended to meet the evolving needs of SOC 2 report users while ensuring the underlying criteria remain relevant as artificial intelligence, automation, and other emerging technologies alter third-party risk considerations.

In addition to targeted restructuring of the criteria, the exposure draft incorporates expanded considerations for AI and other emerging technologies. For example, new points of focus address issues such as AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management, and the risks associated with automated decision-making.

— To comment on this article or to suggest an idea for another article, contact Bryan Strickland at Bryan.Strickland@aicpa-cima.com.