They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
AT-C 205 · FIVE TRUST SERVICES CATEGORIES
SOC 2 · Trust Services Criteria · Confidentiality
SOC 2 Confidentiality Criteria Protect Confidential Data
Demonstrate your commitment to protecting confidential information from unauthorized disclosure. Confidentiality criteria prove you have controls to protect sensitive data — critical for companies handling proprietary information, trade secrets, or customer confidential data.
Confidentiality is an optional Trust Services Criteria (the C1.x series) — only Security (CC1–CC9) is mandatory in every SOC 2 report.
AES-256Encryption at rest standard
300+SOC 2 engagements
100+SOC 1 reports
AICPA Trust Services Criteria · SSAE 18 attestation · Last reviewed June 2026
Direct Answer
Is the Confidentiality criterion mandatory?
The SOC 2 Confidentiality criterion (the C1.x Trust Services Criteria) requires that information designated as confidential is protected from unauthorized collection, use, disclosure, and disposal — from the moment it is obtained through to secure destruction. Defined by the AICPA (aicpa-cima.com), it is an optional add-on category, scoped in alongside the mandatory Security criteria by organizations that handle trade secrets or other confidential business data. It protects confidential business information, which is distinct from the Privacy criteria that govern personal data.
Key Takeaways
- Confidentiality is an optional SOC 2 category (C1.x) — only Security (CC1–CC9) is mandatory — chosen by organizations handling confidential business data.
- It protects confidential business information (trade secrets, proprietary methods), while Privacy (P1–P8) separately protects personal data (PII).
- Core controls are data classification, AES-256 encryption at rest, TLS 1.2+ in transit, least-privilege access, NDAs, DLP, and secure disposal.
- Tranquility Cybersecurity delivers SOC 2 (Security + Confidentiality) at an indicative ₹2–3L (Type 1) to ₹3–5L (Type 2), all-in, across 300+ SOC 2 engagements.
The Criterion
What is the SOC 2 Confidentiality criteria?
Confidentiality criteria demonstrate that your organization protects confidential information from unauthorized disclosure. Unlike Security criteria (which is mandatory), Confidentiality is optional — but it's critical for companies handling sensitive proprietary data.
If your customers share confidential information with you (trade secrets, proprietary algorithms, financial data, strategic plans), you should include Confidentiality in your SOC 2 report.
- Optional but Critical for Confidential Data Handlers Companies handling trade secrets, proprietary data, or confidential customer information need this
- Proves Data Classification & Protection Validates systematic approach to identifying and protecting confidential data
- Covers Encryption & Access Controls Demonstrates encryption at rest/in transit and strict access controls
- Required by Enterprise Customers with Proprietary Data Companies sharing trade secrets often require Confidentiality in SOC 2 reports
Confidentiality vs Privacy vs Security
Confidentiality
Protects confidential business data (trade secrets, proprietary info)
Privacy
Protects personal data (PII, GDPR, data subject rights)
Security
Protects all data from unauthorized access (mandatory for SOC 2)
The Controls
8 Key Confidentiality Controls
Implement these controls to demonstrate confidential data protection and meet SOC 2 Confidentiality criteria requirements.
Data Classification
Systematic classification of data based on sensitivity and confidentiality requirements.
Key Implementation Points
- Data classification policy documented
- Classification levels defined (Public, Internal, Confidential, Restricted)
- Data labeling and tagging procedures
- Classification review and updates
- Employee training on data classification
Encryption at Rest
Encryption of confidential data stored in databases, file systems, and backups.
Key Implementation Points
- AES-256 encryption for databases
- Encrypted file storage for confidential documents
- Encrypted backups with separate keys
- Full disk encryption for servers
- Key rotation procedures documented
Encryption in Transit
Protection of confidential data during transmission over networks.
Key Implementation Points
- TLS 1.2+ for all external communications
- VPN for remote access to confidential systems
- Encrypted API communications
- Certificate management and renewal
- Prohibition of unencrypted protocols (FTP, HTTP)
Access Controls for Confidential Data
Strict access controls ensuring only authorized personnel can access confidential data.
Key Implementation Points
- Role-based access control (RBAC) for confidential data
- Principle of least privilege enforced
- Access request and approval workflows
- Quarterly access reviews for confidential systems
- Access revocation upon termination
Non-Disclosure Agreements (NDAs)
Legal agreements to protect confidential information from unauthorized disclosure.
Key Implementation Points
- NDAs signed by all employees
- Vendor NDAs for third-party access
- Customer NDAs for mutual confidentiality
- NDA tracking and renewal processes
- Confidentiality clauses in employment contracts
Confidential Data Handling Procedures
Documented procedures for handling, storing, and disposing of confidential data.
Key Implementation Points
- Confidential data handling policy
- Secure storage requirements (encrypted, access-controlled)
- Secure disposal procedures (shredding, wiping)
- Transmission guidelines (encrypted channels only)
- Incident response for confidentiality breaches
Data Loss Prevention (DLP)
Technologies and processes to prevent unauthorized disclosure of confidential data.
Key Implementation Points
- DLP tools for email and file sharing
- USB/removable media restrictions
- Cloud storage monitoring and controls
- Screen sharing and screenshot restrictions
- DLP policy violations monitoring
Confidentiality Awareness Training
Regular training to ensure employees understand confidentiality requirements.
Key Implementation Points
- Annual confidentiality training for all employees
- Onboarding training on data classification
- Phishing simulations for confidential data protection
- Confidentiality policy acknowledgment
- Training completion tracking and reporting
From the Audit Floor
Common Confidentiality Mistakes
The patterns we see derail Confidentiality evidence — and how to keep your report clean the first time.
No Data Classification Policy
Without data classification, employees don't know what data is confidential and how to protect it.
Fix: Implement data classification policy with clear levels (Public, Internal, Confidential, Restricted) and labeling procedures.
Unencrypted Confidential Data
Storing confidential data without encryption exposes it to unauthorized access.
Fix: Implement AES-256 encryption for databases, file storage, and backups containing confidential data.
Missing NDAs
Employees and vendors without NDAs have no legal obligation to protect confidential information.
Fix: Require NDAs for all employees, contractors, and vendors with access to confidential data.
Overly Broad Access to Confidential Data
Granting wide access to confidential data violates the principle of least privilege.
Fix: Implement RBAC with strict access controls and quarterly access reviews for confidential systems.
No DLP Controls
Without DLP, confidential data can be easily exfiltrated via email, USB, or cloud storage.
Fix: Implement DLP tools for email/file sharing, USB restrictions, and cloud storage monitoring.
Insecure Data Disposal
Improper disposal of confidential data (e.g., deleting files without wiping) can lead to data leakage.
Fix: Implement secure disposal procedures (shredding for physical, wiping for digital) with documented evidence.
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions on the SOC 2 Confidentiality criterion, data classification, and encryption.
What does the SOC 2 Confidentiality criterion require?
The Confidentiality criterion (the C1.x Trust Services Criteria) requires that information designated as confidential is protected from collection, use, retention, disclosure, and disposal in ways that are not authorized — from the point it is obtained through to its secure destruction. In practice that means data classification, encryption at rest and in transit, restricted access, NDAs, and secure disposal. It is published by the AICPA (https://www.aicpa-cima.com) as one of the five Trust Services Criteria.
Is the Confidentiality criterion mandatory for SOC 2?
No. Only the Security category (Common Criteria CC1–CC9) is mandatory in every SOC 2 report. Confidentiality is one of four optional categories — alongside Availability, Processing Integrity, and Privacy — that an organization scopes in based on customer demand. Companies that receive trade secrets, proprietary algorithms, strategic plans, or other confidential business data under NDA usually add Confidentiality.
What is the difference between Confidentiality and Privacy in SOC 2?
Confidentiality protects confidential business information — trade secrets, proprietary methods, contracts, strategic plans — regardless of whose it is. Privacy (the P1–P8 criteria) specifically protects personal information (PII) and governs how it is collected, used, retained, disclosed, and disposed of, aligned with notice-and-choice principles. A company that handles a customer's proprietary algorithm needs Confidentiality, while a company that handles individuals' personal data needs Privacy. Many organizations scope in both.
What encryption standards are expected for SOC 2 Confidentiality?
At rest, AES-256 for databases, file storage, and backups is the common standard. In transit, TLS 1.2 or higher for all external communication, with VPN for remote access. Key management should use a dedicated service (AWS KMS, Azure Key Vault, or HashiCorp Vault) with documented key-rotation procedures and separation of keys by data type. Weak ciphers (DES, 3DES, RC4) and unencrypted protocols (FTP, HTTP, Telnet) should be retired before the observation period.
What evidence will auditors request for the Confidentiality criterion?
Auditors typically request the data-classification policy, encryption evidence (settings and key-management procedures), NDA tracking for employees and vendors, access-control logs showing RBAC and periodic access reviews, DLP configurations and violation reports, confidentiality-training completion records, and secure-disposal logs. For a Type 2 report this evidence must cover the full observation period. Tranquility Cybersecurity helps teams build and evidence these controls as part of a SOC 2 engagement (indicative ₹2–5L, all-in).
Continue your SOC 2 research
- SOC 2 compliance hub — all five Trust Services Criteria, Type 1 vs Type 2, timelines, and costs.
- SOC 2 Trust Services Criteria — all five categories, the common criteria every report includes, and how to choose what goes in scope.
- SOC 2 consulting for Indian companies — Security + Confidentiality readiness through attestation at an indicative ₹2–5L, all-in.
- Tranquility Cybersecurity credentials & proof — 300+ SOC 2 engagements to date.
Keep Exploring
Related Reading
SOC 2
Trust Services Criteria
Security, Availability, Confidentiality, Processing Integrity, Privacy.
Read moreSOC 2
TSC: Security (CC Series)
The mandatory common criteria — every SOC 2 report includes these.
Read moreSOC 2
TSC: Privacy
PII lifecycle management aligned with AICPA privacy principles.
Read moreSOC 2
SOC 2 Knowledge Hub
Type 1 vs Type 2, criteria, timelines and audit prep — all guides.
Read moreISO 27001
ISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read moreSOC 2
SOC 2 Audit Preparation
Evidence, readiness checks and what the CPA firm will sample.
Read more
The Learn Library
Go deeper.
SOC 2 · Learn
The SOC 2 Controls List
The control families behind the criteria, with examples.
Read moreSOC 2 · Learn
Choosing Trust Services Criteria
Which of the five categories belong in your report, and why.
Read moreSOC 2 · Learn
Confidentiality vs Privacy
Two criteria teams conflate — and the different evidence each needs.
Read more