SOC 2 — Trust Services Criteria

Common Criteria (CC1–CC9) Coverage

The Windows and Linux event codes that give an auditor direct evidence for each event-evidenced SOC 2 Common Criterion below.

Scope: Covers the Security category's Common Criteria (CC1–CC9) — the only Trust Services category mandatory in every SOC 2 report. Availability, Processing Integrity, Confidentiality, and Privacy are optional, engagement-specific categories layered on top of Security and aren't covered here. Ten of the nineteen Common Criteria points genuinely evidenced by log content are mapped below; the rest — governance, risk assessment, communication, physical access, incident-response program existence — are named honestly in the gap section rather than force-mapped.

Sourcing: The AICPA's Trust Services Criteria is a paid AICPA publication — the exact numbered criteria wording isn't freely reproducible. The summaries below are this site's own paraphrase of what each criterion asks, the same approach used for every other framework here, not a verbatim quote.