PW-SOC2-001
SOC 2 Type 1 vs Type 2 for seed startups
When seed SaaS should pursue Type 1 vs Type 2, what each proves, and how buyers usually sequence them.
PW-SOC2-007 SOC 2 readiness spoke
SOC 2 Security-only vs Availability / Confidentiality
TL;DR. Most first reports cover Security (Common Criteria) only. Add Availability if uptime SLAs and resilience are buyer-visible; add Confidentiality when handling sensitive customer data is central to the deal. Extra categories mean more controls, evidence, and cost.
Claim ladder Material statements on this page are labeled Verified, Inferred, or Unknown per editorial standards.
Key terms: Trust Services Criteria, Common Criteria.
On this page
Security (Common Criteria) first
Security is the baseline category and includes the Common Criteria. Most seed Type 1 reports start here. It covers control environment, communication, risk, monitoring, and logical/physical access themes relevant to your system.
When to add Availability or Confidentiality
- Availability — customers care about uptime, DR, capacity; you already test restores and track incidents against SLAs.
- Confidentiality — protecting confidential information is a contractual centerpiece beyond general security claims.
Adding categories expands testing and evidence. Start narrow unless a named deal requires otherwise—and document that requirement.
Questions founders ask
Is Security the same as Common Criteria?
Security uses the Common Criteria as its foundation in the TSC model.
Do we need Privacy too?
Only if in scope for your commitments; it is a separate category with more work.
Can we add Availability later?
Yes in a later period/report—plan evidence now if you expect to.
Sources
- primary 2017 Trust Services Criteria (With Revised Points of Focus – 2022) — AICPA & CIMA — Authoritative TSC document (Security/Availability/Processing Integrity/Confidentiality/Privacy).
- primary SOC 2 — SOC for Service Organizations: Trust Services Criteria — AICPA & CIMA — Official SOC 2 topic landing; defines SOC 2 as examination of controls relevant to TSC categories.