Defining SOC 2 Scope: Systems, Locations and Which TSCs to Include

System description essentials

• Services and customer-facing features
• Infrastructure locations and cloud accounts
• People and supporting corp IT touchpoints
• Subservice organisations and CUECs

Choosing TSCs

Security always; add Availability, Confidentiality, Processing Integrity, and/or Privacy only when commitments require them.

Scope change control

New regions, acquisitions, and major features should trigger scope review mid-period, not surprises at fieldwork.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Can we exclude corporate laptop management?

Sometimes via carve-outs — only if product operations truly do not depend on those controls; auditors will probe.

Are multi-product companies one report?

Often multiple system descriptions or reports — decide with your auditor.

How does GRC help?

Tracks in-scope assets and control ownership as the boundary evolves.

Related Resources

• SOC 2 hub
• Availability criteria