AICPA Description Criteria for a Description of a Service Organization's System (DC Section 200, 2018/2022)

AICPA criteria for describing a service organisation system in SOC 1 and SOC 2 reports, covering system boundaries, controls, and complementary controls. Applies to service organisations and their auditors.

AICPA DC Section 200 (SOC 2 Description Criteria) applies to service organizations, SaaS providers, cloud service providers, data centers, managed service providers, technology companies, financial services firms.

AuditDSS has decomposed AICPA DC Section 200 (SOC 2 Description Criteria) into 27 atomic obligations from 9 rules. Each obligation is independently testable and risk-scored.

The key requirements include: 9 Description Criteria (DC1-DC9), Types of services provided (DC1), Principal service commitments and system requirements (DC2), System components: infrastructure, software, people, procedures, data (DC3), System incidents from control failures (DC4), Applicable trust services criteria and related controls (DC5), Complementary user entity controls (DC6), Subservice organization disclosures — inclusive and carve-out methods (DC7), Non-relevant trust services criteria and reasons (DC8), Significant changes during the period for type 2 (DC9).

Upload your compliance policy to AuditDSS. The platform maps your document against all 27 AICPA DC Section 200 (SOC 2 Description Criteria) obligations using deterministic AI scoring — not checklists or LLM summaries. You get a risk-scored gap analysis showing exactly which obligations are covered, partially covered, or missing.

AICPA DC Section 200 (SOC 2 Description Criteria) is enforced in United States by American Institute of Certified Public Accountants.

AICPA DC Section 200 (SOC 2 Description Criteria) became effective on January 1, 2022.

AICPA DC Section 200 (SOC 2 Description Criteria) is primarily relevant to the Medical Devices & Diagnostics industry. AuditDSS covers 64 regulations in this industry sector.