Which of the following is NOT a SOC 2 trust service criterion?

Which of the following is NOT a SOC 2 trust service criterion?

• A. Security
• B. Availability
• C. Data backup
• D. Processing Integrity

Answer: (C)

The SOC 2 framework uses five trust service criteria: security, availability, processing integrity, confidentiality, and privacy. Data backup is an important control activity that supports continuity and recovery, but it is not itself one of the five criteria. It helps meet the criterion of availability by enabling restoration after an interruption, yet the criteria themselves are the five areas listed. So data backup is not a dedicated trust service criterion, which is why it’s the correct choice.

The SOC 2 framework uses five trust service criteria: security, availability, processing integrity, confidentiality, and privacy. Data backup is an important control activity that supports continuity and recovery, but it is not itself one of the five criteria. It helps meet the criterion of availability by enabling restoration after an interruption, yet the criteria themselves are the five areas listed. So data backup is not a dedicated trust service criterion, which is why it’s the correct choice.