The 2027 SOC 2 Trust Services Criteria are an AICPA exposure draft, not a final standard. Comments are due January 15, 2027, and if the draft is issued as final it applies to engagements beginning on or after December 31, 2027, with early adoption permitted. The draft cuts the common criteria from 33 to 20, gives vendor management its own category, and adds AI-related points of focus to 17 criteria. Nothing changes for a SOC 2 examination today, but organizations that plan audits for 2028 should know what is coming. This article covers the dates, the major changes to prepare for, a crosswalk from the 2017 criteria, and what to do before the text is final.
Key Dates for the 2027 SOC 2 Trust Services Criteria
| Item | Detail |
|---|---|
| Comments due | January 15, 2027 |
| Effective date, if issued as final | Engagements beginning on or after December 31, 2027 |
| Early adoption | Permitted |
| Until then | The 2017 criteria with the 2022 revised points of focus remain current |
The AICPA defines the effective date by when an engagement begins, not by when the report period ends, so a Type 2 period that spans December 31, 2027 is a question to put to your service auditor. The draft is dated October 27, 2026 and applies to SOC 2 and SOC 3 engagements, while SOC for Cybersecurity and SOC for Supply Chain stay on the 2017 criteria. The matching Description Criteria draft has not been released yet.
What Happens Between Now and the Effective Date
The comment period runs to January 15, 2027, and the AICPA’s Assurance Services Executive Committee considers the comments it receives. It may then revise the draft and issue a final version, and the draft does not say when that would happen. If it is issued as final, the December 31, 2027 date applies unless the final text changes it, and early adoption stays optional. Until then, every statement about what the criteria will require is provisional.
Three questions are worth putting to your service auditor now: which version of the criteria applies to your next engagement, whether the firm will offer early adoption, and how the engagement start date works for a Type 2 period that spans December 31, 2027. The answers depend on the firm’s own engagement timing, so it helps to have them before a 2028 audit is scheduled.
Major Changes to Prepare For
Fewer Criteria in Eight Categories
The common criteria, which apply to every SOC 2 examination, go from 33 criteria in nine series to 20 in eight: control environment, information and communication, risk assessment, monitoring activities, logical and physical asset protection, system operations, system development and change management, and vendor management. Asset protection has the most criteria. The AICPA gives two aims: to reduce complexity by combining similar criteria, removing unnecessary ones, and rewriting the language so it is uniform, and to modernize the criteria for emerging technologies such as AI.
The drop from 33 to 20 applies to the common criteria only. The additional criteria change less: availability goes from three criteria to four, confidentiality from two to three, and processing integrity (five) and privacy (eighteen) keep their counts. These counts are Elevate’s reading of the draft against the 2017 criteria, because the draft does not publish one. Criteria remain outcome statements, and the points of focus beneath them are not a checklist. No point of focus requires a specific control, and an examination does not require assessing whether each one is addressed.
Vendor Management Becomes a Category
Vendor and business partner risk was criterion CC9.2 in 2017, and the draft makes it a category of its own, CC8. Its points of focus describe a full vendor program: specific requirements for each engagement covering scope, roles, compliance, and service levels; evaluation of the vulnerabilities that vendor relationships create, including third-party access and network connections; and a vendor inventory that is tiered and assessed periodically, including the vendors’ own vendors. They also cover accountability, communication and exception handling, performance reviews, subservice organizations, termination procedures, and confidentiality and privacy commitments from vendors.
One point of focus is new in emphasis. External components, which may include hardware, software, AI models, APIs, and plugins, are evaluated for security and reliability before use and after updates. For a service organization that builds on third-party AI, that is where the vendor program meets the AI points of focus. Elevate’s guide to vendor risk assessment covers the process.
AI Points of Focus in 17 Criteria
The draft adds AI-related points of focus to 17 criteria, and 12 of them are common criteria, so they bear on every SOC 2 examination. The other five sit in the availability, processing integrity, and privacy series, which apply only when those categories are in scope. The points of focus cover AI-specific risks such as training data manipulation, adversarial inputs, and prompt injection, access reviews that include AI and other technology accounts, controls against unsanctioned AI tools and unauthorized AI software, monitoring AI components for drift and anomalous outputs, evaluating changes to training data, informing users when outputs are AI-generated, and AI components supplied by vendors.
Several are conditional. The training data points apply when the entity has the ability to train an AI model, so an organization that only calls a third-party model sees a lighter version, with more weight on vendor management. These points of focus guide how an auditor evaluates a system that uses AI and do not create a mandatory list of controls. An auditor working from them might reasonably ask where the AI components are, who approved changes to their data, how drift is detected, and which AI tools employees may use.
Business Disruption Planning Moves Under Availability
The 2017 criteria covered business disruption risk in the common criteria, as CC9.1. The draft has no common criterion for it, and the related points of focus, on planning for the mitigation of business disruption risks and on testing business continuity and crisis management plans, appear in the availability criteria. A Security-only examination therefore appears not to evaluate them. That is an inference from the structure of the draft, and it is worth confirming with your service auditor.
If customers expect continuity evidence, the question becomes whether to add the availability category to the examination. It is also a reasonable topic for a comment to the AICPA, because it changes what a Security-only report covers.
SOC 2 Criteria Crosswalk: 2017 to 2027
The AICPA has not published a crosswalk, so this one is Elevate’s mapping by subject matter, built from the titles and points of focus of each 2027 criterion. Use it to see where a control mapped to a 2017 criterion lands in the draft.
| 2017 criterion | Where it goes in the 2027 draft |
|---|---|
| CC1.1 Integrity and ethical values | CC1.1 |
| CC1.2 Board independence and oversight | CC1.1, as a point of focus |
| CC1.3 Structures, reporting lines, and authorities | CC1.2 and CC2.2, as points of focus |
| CC1.4 Attracting, developing, and retaining competent people | CC1.2 |
| CC1.5 Accountability for internal control | CC1.1 and CC1.2, as points of focus |
| CC2.1 Relevant, quality information | CC2.1, now framed as documented policies, system components, and data |
| CC2.2 Internal communication | CC2.2 |
| CC2.3 External communication | CC2.2, which now covers internal and external parties |
| CC3.1 Clear objectives | CC3.1, now framed as a risk management program |
| CC3.2 Risk identification and analysis | CC3.2 |
| CC3.3 Fraud risk | CC3.2, as a point of focus |
| CC3.4 Changes that affect internal control | CC3.3, as a point of focus |
| CC4.1 Ongoing and separate evaluations | CC4.1 |
| CC4.2 Communicating deficiencies | CC4.1 |
| CC5.1 Control activities that mitigate risk | No criterion of its own; see CC3.2 and the specific control criteria |
| CC5.2 General controls over technology | No criterion of its own; see CC5 to CC7 |
| CC5.3 Policies and procedures | CC2.1 |
| CC6.1 Logical access security | CC5.1 |
| CC6.2 Registering users and issuing and removing credentials | CC5.1 |
| CC6.3 Role-based access, least privilege, and segregation of duties | CC5.1 |
| CC6.4 Physical access | CC5.2 |
| CC6.5 Secure disposal of assets | CC5.3, as a point of focus |
| CC6.6 Protection against outside threats | CC5.4 |
| CC6.7 Protecting information in transmission, movement, and removal | CC5.5 (encryption) and CC5.4 (restricting transmission) |
| CC6.8 Malicious software | CC5.3 |
| CC7.1 Vulnerability and configuration monitoring | CC5.6 |
| CC7.2 Monitoring for anomalies | CC6.1 |
| CC7.3 Evaluating security events | CC6.1 |
| CC7.4 Incident response | CC6.2 |
| CC7.5 Recovering from incidents | CC6.2 |
| CC8.1 Change management | CC7.1, CC7.2, and CC7.3, by type of change |
| CC9.1 Business disruption risk mitigation | Availability criteria, as points of focus; no common criterion |
| CC9.2 Vendor and business partner risk | CC8.1 |
If your control matrix is mapped to 2017 criterion numbers, add a column for the 2027 criterion and fill it from this table. Where a row says “as a point of focus”, the subject still applies, but the evidence is cited under a different criterion. Where a row says there is no criterion of its own, look for the same content in the specific control criteria.
Most of the reduction from 33 to 20 comes from merging criteria and turning others into points of focus, not from dropping subjects. Two rows need attention in an examination plan: CC9.1, which leaves the common criteria, and CC5.1 and CC5.2, whose general statement of control activities disappears.
What to Do Before the Draft Is Final
Decide Whether to Comment by January 15
Comments go to the contact on the draft’s cover page, and the AICPA considers them before deciding whether to issue a final version. Comments are most useful when they cite a criterion and propose wording. Three questions are worth raising: how the effective date applies to a Type 2 period that spans December 31, 2027, how the business disruption points of focus apply to a Security-only examination, and how the AI points of focus apply to organizations that use third-party models but do not train their own. These are suggestions from Elevate, not questions the AICPA has asked.
Keep Operating on the 2017 Criteria
Nothing in the draft changes an examination under the 2017 criteria, and the text can change after comments close. Do not rebuild a control matrix around the draft until it is final. A practical sequence is to finish the current examination cycle on the 2017 criteria, keep the crosswalk next to the control matrix, and revisit the question of early adoption once the final text is issued. If an audit is scheduled for 2028, ask your service auditor which version will apply and whether early adoption is offered. Elevate’s SOC 2 readiness assessment and SOC 2 gap analysis guides describe the current baseline.
Start With AI and Vendor Inventories
Two preparations hold up whatever the final text says. The first is an inventory of AI components, with the owner of each, the data it uses, whether the model is built or supplied by a vendor, and who reviews its outputs. The second is a vendor inventory with a tier for each vendor, the access and data it has, the date of the last assessment, and the vendor’s own critical vendors. Add AI-specific risks to the risk assessment, including training data manipulation, adversarial inputs, prompt injection, and model drift, and start keeping access reviews that include service and AI accounts.
Elevate’s risk assessment work and SOC 2 service cover these steps, and its AIUC-1 readiness and AI governance pages cover AI systems. To check where your SOC 2 program stands against the draft, book a call with an Elevate advisor.
Conclusion
The 2027 SOC 2 criteria are a proposal: comments are due January 15, 2027, and the earliest effective date is engagements beginning on or after December 31, 2027. The changes to prepare for are the vendor management category, the AI points of focus, and the move of business disruption planning to availability, and none of them requires action before the text is final.
What is worth doing now is small: ask the service auditor about timing, build the AI and vendor inventories, and decide whether to comment. Elevate Consult prepares organizations for SOC 2 examinations performed by licensed CPA firms and does not issue SOC 2 reports. Book a call with an Elevate advisor to plan for the draft.
Key Takeaways
The 2027 SOC 2 criteria are a proposal, and the preparation that makes sense now is small.
- Comments are due January 15, 2027. Raise questions about timing and about business disruption planning.
- The earliest effective date is engagements beginning on or after December 31, 2027. Early adoption is permitted.
- Three changes matter most. Vendor management becomes a category, AI points of focus appear in 17 criteria, and business disruption planning moves under availability.
- Nothing changes today. Keep operating on the 2017 criteria and ask your auditor about timing.
Frequently Asked Questions
What is the 2027 SOC 2 Trust Services Criteria exposure draft?
It is a proposed revision of the SOC 2 Trust Services Criteria issued by the AICPA Assurance Services Executive Committee SOC 2 Working Group and dated October 27, 2026. It reduces the common criteria from 33 to 20, gives vendor management its own category, and adds points of focus for emerging technologies and AI. It applies to SOC 2 and SOC 3 engagements. Comments are requested by January 15, 2027, and nothing in it is final.
When would the 2027 SOC 2 criteria take effect?
If the draft is issued as final, the criteria would be effective for engagements beginning on or after December 31, 2027, and early implementation would be permitted. Until then, the 2017 criteria with the 2022 revised points of focus remain current. Because the date refers to when an engagement begins, ask your service auditor how it applies to a Type 2 period that spans it, and whether the firm offers early adoption.
What changes in the SOC 2 common criteria?
The common criteria go from nine series to eight and from 33 criteria to 20. Vendor management becomes its own category, change management is widened to cover development, access, device, network, encryption, and vulnerability controls are gathered into one asset protection series, and business disruption planning moves to the availability criteria. The five Trust Services Categories stay, and management still chooses which of the additional categories to include.
Do the 2027 SOC 2 criteria add AI requirements?
They add AI-related points of focus to 17 criteria, 12 of them common criteria that apply to every SOC 2 examination. The points of focus cover AI-specific risks, access reviews that include AI accounts, monitoring for model drift, changes to training data, and AI components from vendors. They do not create mandatory controls, because no point of focus requires a specific control and an examination does not require assessing each one.
Do I need to change anything for my current SOC 2 report?
No. The draft is not final, and an examination under the 2017 criteria is unaffected. Ask your service auditor which criteria will apply to the next engagement. Useful preparation that does not depend on the final text includes an inventory of AI components and vendors, a tiered vendor inventory that records vendors’ own critical vendors, and AI-specific risks in the risk assessment.