ISC Trust Services Criteria · Updated November 2026

Security, Availability, Processing Integrity, Confidentiality, Privacy: Which Criterion Is Which?

Give each criterion a plain-English question rather than memorizing five similar definitions.

Security

Can unauthorized people access or damage the system?

Availability

Is the system available for operation and use as committed or agreed?

Processing integrity

Does processing produce complete, valid, accurate, timely, and authorized results as required?

Confidentiality

Is information designated confidential protected appropriately?

Privacy

Is personal information collected, used, retained, disclosed, and disposed of according to applicable commitments and criteria?

The takeaway

Security protects access. Availability protects uptime. Processing integrity protects processing. Confidentiality protects designated sensitive information. Privacy focuses on personal information practices.

Related Summit guides

SOC reportsContinue with a related Summit CPA Review guide.Data lifecycleContinue with a related Summit CPA Review guide.Access controlsContinue with a related Summit CPA Review guide.

FAQ

Are confidentiality and privacy identical?

No.

Is security relevant to SOC 2?

Yes.

Does processing integrity mean uptime?

No.