A SOC $2$ engagement may evaluate controls over one or more of the following categories of Confidentiality, Availability, Processing integrity, Privacy, or Security.

Regardless of the tested categories, the trust services criteria $($TSC$)$ to test these categories are aligned to the criteria presented in the COSO framework for the following components: Control environment, Control activities, Risk assessment, Information and communication, and Monitoring. The AICPA's points of focus for testing are directed to these components. Select from the option list provided the appropriate statement for each COSO component listed below. Each choice may be used once, more than once, or not at all.