How many controls are in SOC 2, and what actually gets counted

That difference matters for your costs more than for your trivia. A control count is a design choice, and every control you add is something to run, evidence and pay someone to test. Below is the full criteria tally, the story behind the outdated 64, and a practical way to keep your own control list short.

Three numbers that get mixed up

Search results blur three different things into one figure. Pull them apart and the question gets easy. Only one of the three is a requirement, and it is not the one people usually quote.

Criteria

The benchmarks in the AICPA document. There are 61. These are what the auditor evaluates, and the only fixed count in the standard.

Points of focus

Examples printed under each criterion, several hundred in total. The standard says you do not have to assess each one.³ Useful as prompts. Not a checklist.

Controls

What your company actually does, such as reviewing access or approving code changes. The standard deliberately leaves the number to you.

The standard says it plainly. The criteria are meant to be used for evaluation regardless of which specific controls management puts in place.¹ So when a vendor says SOC 2 has a certain number of controls, it is telling you the size of its own library.

The full count of the 61 criteria

The AICPA document never adds itself up. It lays the criteria out by section and leaves the sum to the reader, which is why published counts disagree. Here is the addition with every family shown, so you can check it line by line.

Source: TSP Section 100, the 2017 Trust Services Criteria with the 2022 revised points of focus.¹ The original 2017 issue and the March 2020 edition carry the same 61 identifiers. The 2022 revision only touched points of focus. If a page says the criteria count changed in 2022, it counted something else.

Watch the privacy headings

Privacy has eight section headings numbered P1.0 to P8.0. They look like criteria. They are not. Count them in and you get 69. No other category has a .0 heading, so this is the one place where a careful counter still slips.

Why older pages say 64

The 64 is real. It just belongs to the previous standard. The 2016 Trust Services Principles and Criteria, TSP section 100A, had 64 criteria, and the 2017 version replaced it. AICPA published both in one file, one after the other, so counting each half of the same file gives you both figures.

Look at Confidentiality. It dropped from eight standalone criteria to two, because the 2017 rewrite moved that material into the common criteria, which grew from 27 to 33. Coverage stayed the same. The total simply went down by three.

Your control count is a cost decision

Since the standard sets no control number, the size of your control set is up to you. That is good news for a small team. Every control has a running cost: someone performs it, someone saves the evidence, and the auditor samples it. Two companies can satisfy the same 33 common criteria with control lists that differ threefold, and neither one is more compliant.

Large platforms tend to ship big control libraries, and their pricing reflects a bigger product. Here is what one marketplace reports buyers actually paid:

• Vendr reports a median annual contract value of $20,000 for Vanta, based on purchases completed through its marketplace. Source, checked 2026-07-30.
• Vendr reports a median annual contract value of $24,601 for Drata, based on purchases completed through its marketplace. Source, checked 2026-07-30.
• Vendr reports a median annual contract value of $20,000 for Secureframe, based on purchases completed through its marketplace. Source, checked 2026-07-30.

You do not need that to map controls to 33 criteria. You can do the mapping yourself. Start from the criteria, write one control per real activity you already perform, and only add a control when a criterion is left uncovered. Resist copying a points of focus list into your control set. That is how a Security project quietly becomes a year of work. How many SOC 2 policies you need applies the same logic to documents.

Which criteria your first report covers

Nearly always the 33 common criteria. Security is required in every SOC 2, and the other four categories only come in when a contract or buyer asks for them.² A first report on Security alone is the normal shape. It is not a lesser report.

Be most careful with the 18 privacy criteria. They are the biggest optional block and carry the most evidence, so adding them without a buyer asking is an expensive guess. The scoping tool checks which categories your contracts really require, and the criteria guide explains what each one asks for. We scope Security only, so the 33 common criteria are the set our software works against.

cybersoftware is not a CPA firm. SOC 2 examinations are performed by independent licensed U.S. CPA firms.

Your next step

Want to know how far your current setup is from the 33 common criteria? The free readiness assessment takes about 15 minutes. You get a readiness assessment, score, gap list and one AI sample policy, with no card needed. If the gap list looks manageable, the pricing page shows the monthly and yearly plans side by side, and how audits are priced.