Scoring Model & Architecture AICPA TSC 2022

Assessment Methodology & Scoring Model

How SOC 2 Gap evaluates technical and organizational controls against AICPA Trust Services Criteria 2022.

1. Authoritative Framework & 47 Control Distribution

The SOC 2 Gap readiness engine maps directly to the AICPA Trust Services Criteria (2022 Edition). The full control bank comprises 47 structured questions distributed across five distinct criteria:

Trust Services Criterion AICPA Reference Questions Audit Scope Requirement
Security CC1.1 – CC9.2 22 Mandatory for all SOC 2 audits
Availability A1.1 – A1.3 6 Optional (Uptime & SLA commitments)
Processing Integrity PI1.1 – PI1.5 6 Optional (Transactions & financial data)
Confidentiality C1.1 – C1.2 6 Optional (Trade secrets, IP, sensitive data)
Privacy P1.1 – P8.1 7 Optional (Personal data & PII handling)
Total Question Bank 47 Complete AICPA TSC 2022 coverage

2. 4-Point Maturity Scale

Every question in the assessment is evaluated against a 4-point maturity model calibrated to CPA auditor expectations:

Level 0

Not started (0 Points)

No formal policy, control, or activity exists. Represents a day-one audit gap.

Level 1

Ad hoc / informal (1 Point)

Practiced informally by some engineers; not documented, standardized, or consistently enforced.

Level 2

Defined / documented (2 Points)

Written policy approved by leadership and standardized operating procedures actively followed.

Level 3

Managed / monitored (3 Points)

Automated enforcement, continuous verification, periodic audit reviews, and active alerting.

Not applicable exclusion: Controls marked "Not applicable" are excluded from both the numerator and denominator, preventing unfair score penalties for controls outside your operating environment.

3. Mathematical Scoring Formulas

Our readiness scoring algorithm uses strict, deterministic mathematical formulas:

Criterion Percentage Formula

Criterion Score (%) = [ Σ(Value × Weight) / Σ(3 × Weight) ] × 100%

Calculated over all answered, applicable questions in the criterion. Maximum possible value per question is 3.

Overall Readiness Score Formula

Overall Readiness (%) = (1 / N_in-scope) × Σ (Criterion Score)

The overall readiness score is the unweighted arithmetic mean of all selected in-scope criteria percentages.

Gap Prioritization & Leverage Ranking

Gap Priority = Weight × (3 - Answered Value)

Applicable only to answered questions with maturity 0 or 1. Gaps are sorted descending by priority score. A weight-3 control at maturity 0 produces a maximum priority of 9 (Critical Gap).

4. Readiness Bands & Preparation Windows

Band Name Score Range Status Interpretation Rough Preparation Window
Early 0 – 39% Critical controls missing; policies unwritten or informal. 6–12 months to audit fieldwork
Developing 40 – 69% Key controls established; significant documentation and monitoring gaps remain. 3–6 months to audit fieldwork
Nearly ready 70 – 89% Robust security foundation; minor operational clean-up and evidence collection needed. 1–3 months to audit engagement
Audit ready 90%+ Controls operationalized, monitored, and documented. Ready for independent CPA testing. Ready for audit fieldwork engagement
Important Disclaimer

Readiness estimate only — not legal or audit advice. Only a licensed CPA firm can issue a SOC 2 report. Your answers never leave your browser.

Test Your Controls With Our Free Tools

Run the 47-Question Assessment → Open Compliance Checklist →

Methodology & Scoring FAQs

Detailed technical questions regarding our calculation engine and AICPA standards alignment.

What standard is the question bank based on?

Our 47 questions are mapped directly to the American Institute of Certified Public Accountants (AICPA) Trust Services Criteria (2022 Edition), specifically TSP Section 100. Each question represents an actionable operational control derived from the AICPA's official points of focus.

Why is the Security criterion mandatory for all assessments?

Under AICPA standards, Security (the Common Criteria, CC1.1 through CC9.2) forms the mandatory foundational baseline for every SOC 2 report. You cannot issue a SOC 2 report without evaluating the Common Criteria, whereas Availability, Processing Integrity, Confidentiality, and Privacy are optional additional criteria.

How does the "Not applicable" option affect my score?

When a question is marked "Not applicable", its maximum possible points are completely removed from both the numerator and denominator of the criterion formula. It is never counted as zero, ensuring organizations are not penalized for controls that do not apply to their technology architecture.

What is the difference between a weight of 1 and a weight of 3?

Control weights reflect audit severity and foundational risk. Weight 3 represents critical foundational controls (such as multi-factor authentication, production access segregation, and risk assessments). Weight 2 represents standard operational controls (such as change management testing and vendor reviews). Weight 1 represents supporting documentation and administrative hygiene.

How are the prioritized gaps calculated?

Gaps are calculated exclusively for answered questions with maturity levels 0 (Not started) or 1 (Ad hoc). Each gap is assigned a priority score using the formula: Priority = Weight × (3 - Answered Value). This ranks critical, unstarted controls at the highest priority (e.g. Weight 3 × 3 = 9) to give engineering teams maximum leverage for remediation.

Does a score of 90%+ guarantee an unqualified SOC 2 opinion?

No self-assessment can guarantee an audit outcome. A 90%+ score indicates strong control alignment and readiness, but only an accredited, independent CPA firm conducting rigorous audit fieldwork can evaluate operating effectiveness and issue an official attestation report.