AICPA proposes improvements to SOC 2 trust services criteria
October 29, 2026
The AICPA is seeking feedback on proposed updates to the framework used by CPAs to evaluate controls over an organization’s information systems.
The proposed revisions in SOC 2 Trust Services Criteria for Security are intended to improve the clarity and usability of SOC 2 reports, the AICPA said in a news release. SOC 2 is an examination performed by a licensed, independent CPA under AICPA Attestation Standards.
According to the news release, the proposed updates are intended to meet the evolving needs of SOC 2 report users while ensuring the underlying criteria remain relevant as artificial intelligence, automation and other emerging technologies alter third-party risk considerations.
The AICPA’s SOC 2 Working Group is seeking public comment on the exposure draft through Jan. 15, 2027. If the updates are approved, they would be effective for engagements beginning on or after Dec. 31, 2027, with early adoption permitted. Learn more.
