What it is
SOC 2 reports are built around the Trust Services Criteria. Security is the only category every report includes. Confidentiality sits alongside availability, processing integrity and privacy as an optional category. You add it to scope when your customers care about how you protect their data and yours. If it is not in scope, the auditor does not test it, and the report says nothing about it.
Confidentiality in SOC 2 means information you have designated as confidential and the controls that protect it through its lifecycle. That includes creation, use, sharing, storage, and disposal. It is not a catch-all for every piece of data in the company. You decide what counts, and that decision should be written down before the audit starts.
The category has two criteria points. C1.1 asks you to identify confidential information and maintain controls that meet your objectives for protecting it. C1.2 asks you to dispose of confidential information in a way that meets those objectives. The criteria are broad by design. Your own policies, retention schedule and contracts set the specific bar the auditor tests against.
The report lists the criteria in scope, usually in the description of the system and in the criteria section. If confidentiality is in, expect the auditor to opine on C1.1 and C1.2 and to describe tests for each. If it is out, the report may note that the category was not included.
How it works
The work starts with a definition. Write down what confidential means at your company. A practical scheme uses three or four tiers, such as public, internal, confidential and restricted. Keep the labels simple enough that people apply them without a meeting. Then map where each tier lives: systems, databases, ticketing tools, file shares, laptops, backups and vendors.
Next, connect controls to the two criteria. For C1.1, auditors look for an inventory of confidential data, access restrictions tied to roles, encryption in transit and at rest, key management, confidentiality clauses in employee and vendor contracts, and labeling or handling rules. For C1.2, they look for a retention schedule, disposal methods and records that show disposal happened on time. Secure erase, cryptographic erasure and physical destruction with a certificate are common methods.
If you pursue a Type 2 report, the auditor samples controls across the audit period. Evidence usually includes the classification policy, a data inventory, access lists, encryption settings, signed NDAs, vendor contracts, retention schedules, deletion tickets, and certificates of destruction. A screenshot of a setting helps; a written procedure plus a log of actual deletions helps more.
The auditor does not test every system. They test the controls you say you rely on. That makes your description of the system important. Be accurate about what you do, including the messy parts, because the report has to match reality.
Why it matters for a business
Customers ask for evidence that their data is protected and deleted. Confidentiality criteria answer a sharper question than the security category alone: which data did you treat as sensitive, who could see it, and how did you get rid of it. That matters in deals with banks, healthcare companies, HR platforms and any buyer that sends you files they consider trade secrets.
Adding confidentiality has costs. It widens scope. It adds controls and evidence. It can turn a retention policy you never enforced into a commitment someone checks. If you run a small team and your customers are not asking, it may be reasonable to leave it out for the first report and add it later.
There is operational value too. A data inventory and retention schedule help during incident response, vendor reviews and contract renewals. They make it easier to answer a customer questionnaire without guessing. They also surface old data you no longer need, which is a risk you can remove.
Common mistakes
The first mistake is calling everything confidential. If every record is top secret, the controls become generic and the auditor cannot tell what is in scope. Pick categories and give examples. A pricing sheet and a customer list can be confidential. A public marketing page is not.
The second is a retention schedule that exists on paper only. Auditors ask for evidence of disposal. That means backups, analytics copies, support tickets and shared drives, not just the production database. If the schedule says 90 days and the warehouse keeps data for three years, the schedule is wrong or the system is.
The third is disposal without records. A team says they delete data on request. Then no ticket, no log, no confirmation. Build a simple process: request, approval, deletion, verification, record. For physical media, keep the certificate. For cloud systems, keep a log export.
Another mistake is confusing confidentiality with privacy. Privacy criteria cover personal information and the promises you make about it. Confidentiality covers information you designate as confidential, which can include business records that are not personal. You can need both, but they are separate sections of the report.
How to get started
Start with a one page definition of confidential information and the tiers you will use. Get sign off from leadership and from whoever owns customer contracts. Ambiguity here creates scope creep later.
Then build an inventory. List the systems that store confidential data, who can access them, how data moves in and out, and how long it stays. Add the vendor systems you rely on. A spreadsheet is fine at the start.
Run one disposal cycle end to end. Pick a data set past its retention date, delete it, verify the deletion, and keep the record. That test will show you where the process breaks before an auditor does.
Cloudverg's SOC 2 readiness assessment, a fixed price of $7,500 over 3 weeks, scopes your systems and criteria, runs a gap assessment against the Trust Services Criteria, builds a policy and evidence inventory and leaves you with a remediation roadmap and a shortlist of CPA firms. It is one option. You can also do the scoping in house or hire an auditor directly.
Frequently asked questions
Is confidentiality required for SOC 2?
No. Security is the only category every SOC 2 report must include. Confidentiality is optional and only appears when you put it in scope. If you leave it out, the auditor does not test or opine on it.
What is the difference between the confidentiality criteria and the privacy criteria?
Confidentiality (C1.1 and C1.2) covers information you designate as confidential, such as business records and trade secrets. Privacy (P1 through P8) covers personal information and the promises you make about collecting, using and disposing of it. A report can include one, both or neither.
How many criteria points are in the confidentiality category?
Two. C1.1 covers identifying confidential information and maintaining controls to protect it. C1.2 covers disposing of confidential information on schedule and in a controlled way. Both are tested when confidentiality is in scope.