In partnership with
|
STANDARDS TRACKER |
STANDARDS TRACKER
AICPA proposed 2027 SOC 2 trust services criteria: first restructure since 2017
The AICPA wants to cut 33 common criteria down to 20 and add AI points of focus - first rewrite of the SOC 2 framework since 2017.
The AICPA released an exposure draft on Oct. 27, 2026, proposing the first restructuring of the SOC 2 Trust Services Criteria since the 2017 original. The draft cuts the total criteria from 61 to 50, and the common criteria - the Security set that applies to every SOC 2 report - from 33 to 20. Vendor management gets its own separate category under the proposal, and AI-related points of focus are added to 17 criteria. The five Trust Services Categories themselves are not changing.
BY THE NUMBERS
|
See below EFFECTIVE |
1 SOURCE TRACKED |
|
Nov 2 LAST UPDATED |
OTHER ISSUER |
The proposed 2027 criteria would be effective for engagements beginning on or after Dec. 31, 2027, with early adoption permitted, per the Journal of Accountancy. The comment period closes Jan. 15, 2027. Current SOC 2 reports continue to use the 2017 criteria with 2022 revised points of focus until a final version is issued.
For teams that manage vendor SOC 2 reports as part of their third-party risk or IT controls documentation, the structural changes matter: a new vendor management category and 17 AI-specific points of focus will likely change how auditors frame control objectives and how service organizations document evidence. Crosswalk work between 2017 and 2027 criteria will be needed when and if the standard is finalized.
The AICPA says the updates are intended to meet evolving needs of SOC 2 report users while ensuring criteria remain relevant as AI, automation, and other technologies alter third-party risk considerations. The draft does not introduce AI-specific criteria - it handles AI through points of focus layered onto existing criteria, per the Journal of Accountancy. What the final criteria look like depends on comment-period feedback; nothing is binding yet.
Controllers and finance ops leads who rely on vendor SOC 2 reports for ICFR documentation should track this exposure draft, even though the standard sits in attestation rather than financial reporting. Any renumbering of criteria will require updates to control matrices that cross-reference specific SOC 2 criteria numbers. CPA Practice Advisor reports the comment deadline is Jan. 15, 2027.
WHAT TO DO IN THE CLOSE
| Log the Jan. 15, 2027 comment deadline and assign someone to review the exposure draft before then. | |
| Pull your current vendor SOC 2 control crosswalk matrices and note which reference specific 2017 common criteria numbers (CC1-CC9). | |
| Flag the proposed vendor management category to your IT controls or third-party risk team as a new control domain to plan for. | |
| Do not update any SOC 2 documentation to the 2027 draft yet - current engagements still run against 2017 criteria. | |
| If your firm performs SOC 2 examinations, consult the AICPA-CIMA resource page for the full exposure draft text before responding. |
9 out of 10 clients get approved for Cherry Plans
At Cherry, we provide payment plans to 90% of pet parents. Plus, we make applying easy – with a 35-second online application they can submit right in the treatment room, and a soft credit check that doesn’t ding their credit history.
Don’t let cost get in the way of care - with Cherry.
* These figures come from Cherry's provider case studies, so individual results vary. Details at withcherry.com/provider-reviews. Payment options through Cherry are issued by the following financing partners: withcherry.com/financing-partners
SPONSORED
QUESTIONS THIS ANSWERS
Are the 2027 SOC 2 trust services criteria final?
No. As of Oct. 27, 2026, the 2027 criteria are an exposure draft only. The comment period runs through Jan. 15, 2027. Current SOC 2 examinations continue to use the 2017 criteria with 2022 revised points of focus.
How many criteria does the 2027 SOC 2 draft propose?
The draft proposes 50 total criteria, down from 61, with 20 common criteria, down from 33. It adds AI-related points of focus to 17 criteria but does not create separate AI-specific criteria, per the Journal of Accountancy.
When would the proposed 2027 SOC 2 criteria take effect?
The proposed effective date is for engagements beginning on or after Dec. 31, 2027, with early adoption permitted, per the Journal of Accountancy. Final issuance depends on the outcome of the comment process.
SOURCES
Where this comes from
Every posting on the board is verified live.
GO DEEPER
Go deeper
IN THIS SERIES
Previously: FASB proposed ASU: consideration payable to a customer under Topic 606
A living page: it is re-read and updated as coverage arrives; last updated Monday November 2. Facts come from the linked sources; confirm against the issuer's own text before relying on it.
Audit Friendly's flagship weekly for the people who run the close: the tools, the workflows, what the roles pay and who is hiring.
Accounting Stack · Audit Friendly Data · Accounting & Finance Jobs
Audit Friendly · members.auditfriendly.co