How many controls does SOC 2 require?

The standard counts criteria, not controls

Founders ask me this in the first ten minutes of almost every call. How many controls do we need. They have usually seen a number somewhere, 64 or 80 or 120, and they want to know which one is right.

None of them. The SOC 2 rulebook does not contain a list of controls, and it never has.

What it contains is criteria. The AICPA, the body that writes the standard, publishes the trust services criteria: a set of statements about what has to be true of your system. Criteria describe outcomes. Controls are the things you actually do to make those outcomes true, and you write them.

That distinction is the whole answer. Your auditor tests whether your controls meet the criteria. Nobody checks your controls against a master list, because there is no master list.

Your scope decides how many of the 61 apply

Most first SOC 2 reports cover Security only. That is 33 criteria, and it is the right starting scope for almost every small company I speak to.

Adding a category is not a small decision. Privacy on its own is another 18 criteria, more than half again the work of a Security-only report. It is also the category people add most often because a customer said the word, without either side checking what it commits them to.

A working control library lands in the eighties

So if there is no list, what does a real one look like.

Ours lists 89 controls and 369 test steps, published in full. Every one of the 61 criteria is covered by something in it, and you can read every control and every test without talking to us.

That number is not a target. A control that reads "access is reviewed quarterly" and a control that reads "access to production is reviewed quarterly by the engineering lead and recorded in the ticket" are the same control at different resolutions. Split one into three and your count goes up while nothing about your security changes.

What matters is coverage. Every criterion in your scope has to be addressed by something. The count is bookkeeping.

Points of focus are guidance, and people read them as a checklist

Underneath each criterion the AICPA lists points of focus. These are examples of what an organization might do to meet it. The standard says plainly that they are guidance and that you are not required to address every one.

I raise this because points of focus are where inflated control counts come from. There are a few hundred of them across the framework. Treat each as a requirement and you generate a library nobody can maintain, most of it describing things that do not apply to a company of five people.

They are prompts. They are genuinely useful read that way.

Three things actually decide your number

Your scope. Security only, or Security plus something else. This moves the number more than anything.

Your stack. A company running one cloud account and one identity provider needs fewer controls than one running three clouds, because there are fewer places for the same criterion to land.

Your appetite for detail. Some firms write few broad controls, some write many narrow ones. Narrow controls are easier to test and easier to fail. Broad ones are harder to evidence.

None of those is something you can look up. If a provider hands you a fixed control list and cannot explain which parts do not apply to you, that is worth asking about before you sign anything.