Payroll Processor Chooses Trust Services Criteria Before Fieldwork
Northline Pay is a 180-person SaaS provider that calculates payroll for 2,000 client companies covering 310,000 employee records. Its enterprise sales team has been asked to supply a SOC 2 Type II report. The CISO proposes a scope of Security and Availability only, arguing that 'confidentiality is covered by security' and that client contracts already require deletion of payroll data within 35 days of termination. The platform stores W-2 and direct-deposit data, and the company also collects its own applicants' resumes and employee health-benefit selections. One prospective client, a healthcare system, has asked specifically whether the report covers the HIPAA-related confidentiality commitments in its business associate agreement. Northline has a 99.9% uptime SLA in its master services agreement. The audit firm has completed a readiness assessment and needs a final criteria decision before fieldwork begins in three weeks.
1. Which trust services criteria should Northline include, and what reasoning supports each inclusion or exclusion?
Read the worked answer
Security is mandatory for any SOC 2 engagement because the common criteria underpin the other categories. Availability is strongly indicated: Northline has a 99.9% uptime commitment in its master services agreement, so availability controls and monitoring are part of what users rely on. Confidentiality is also indicated. Payroll, W-2, and direct-deposit data are information that clients and regulators treat as confidential, and the 35-day deletion promise is a confidentiality commitment that must be described and tested. Security alone does not test whether data is deleted on schedule or whether confidential information is protected throughout its lifecycle.
Privacy is a separate judgement. The Privacy criteria are designed for personal information collected or used by the entity in its own right, such as applicant resumes and employee benefit selections. For client payroll data, Northline generally acts as a processor, so the client's privacy obligations do not automatically become Northline's Privacy criteria scope. Management could include Privacy if it wants to cover its own workforce and applicant data, but that expands the system description, notices, consent, and data-subject request testing. The cleaner first-year scope is Security, Availability, and Confidentiality, with a clear statement that the report is not a HIPAA certification and does not replace the business associate agreement.
2. The CISO says 'confidentiality is covered by security.' Evaluate that claim and explain the practical consequence for control design and evidence.
Read the worked answer
The claim confuses protection from unauthorized access with the full confidentiality objective. Security controls address logical access, change management, and incident response. Confidentiality criteria ask whether information designated as confidential is protected throughout its lifecycle, including identification, retention, disposal, and handling by third parties. A strong firewall does not demonstrate that terminated client data was deleted within 35 days.
Practically, Northline needs controls and evidence for the confidentiality commitments: a data inventory and classification scheme; contractual and regulatory confidentiality obligations mapped to systems; retention and deletion jobs with logs; deletion certificates or tickets for terminated clients; media sanitization; and vendor confidentiality terms. The auditor will want to see the population of terminated clients in the period and evidence that deletion occurred within the stated 35 days, not just a policy statement. If management keeps the narrower scope, it should not describe the report as covering confidentiality commitments. The healthcare prospect may still ask for HIPAA safeguards, which are a separate legal regime.
3. Draft a short positioning statement for the healthcare prospect that accurately describes what the SOC 2 report will and will not cover.
Read the worked answer
A defensible statement would say: 'Our SOC 2 Type II report will cover Security, Availability, and Confidentiality for the period stated in the report. The Confidentiality criteria include controls over confidential client payroll data, including retention and deletion commitments. The report is issued under AICPA trust services criteria and is not a HIPAA certification, nor does it replace our business associate agreement or your HIPAA compliance programme. The report will describe controls we operate and complementary controls that customers must perform, such as authorizing users and notifying us of terminations. It will not test your internal HIPAA safeguards or provide a legal opinion.'
This wording avoids two common errors: implying that SOC 2 is a HIPAA certification, and implying that the report covers controls the customer or another vendor must operate. If the prospect needs evidence of HIPAA safeguards, Northline should provide its BAA, security policies, and a mapping of SOC 2 controls to the relevant HIPAA requirements, while making clear that the mapping is management's and not the auditor's opinion.