SOC 2 Trust Services Criteria Structure

Criteria identifiers and category structure for Security, Availability, Processing Integrity, Confidentiality and Privacy, with mapping hooks into the Cybersecurity Core Ontology. Criteria text must be obtained from the AICPA.

• nimble.cyber.core>=1.0.0Cybersecurity Core Ontology

• v2017.3latestNimble ≥ 1.0.08/29/2026

  Current release.

• v0.9.0Nimble ≥ 1.0.01/31/2026

  Initial public preview.

Nimble consumes this machine-readable manifest when resolving and installing the package.

{
  "package": {
    "id": "soc2.tsc",
    "name": "SOC 2 Trust Services Criteria Structure",
    "version": "2017.3",
    "status": "published"
  },
  "publisher": {
    "name": "AICPA",
    "type": "standards-body"
  },
  "domains": [
    "cybersecurity"
  ],
  "solution_areas": [
    "soc-2",
    "grc"
  ],
  "artifacts": [
    "standards-mapping"
  ],
  "dependencies": [
    {
      "id": "nimble.cyber.core",
      "version": ">=1.0.0",
      "optional": false
    }
  ],
  "compatibility": {
    "nimble": {
      "minimum": "1.0.0",
      "maximum": null
    }
  },
  "license": {
    "type": "PROPRIETARY",
    "name": "Proprietary — obtain from source",
    "url": null,
    "redistribution": "link-only",
    "attribution_required": true,
    "attribution": "AICPA Trust Services Criteria. Copyright AICPA. Not redistributed.",
    "source_authority": "AICPA",
    "source_url": "https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services"
  },
  "validation": {
    "security": "scanned",
    "validation": "validated"
  },
  "contents": {
    "mappings": [
      "tsc-identifiers.csv"
    ],
    "documentation": [
      "README.md",
      "LICENSING.md"
    ]
  },
  "distribution": {
    "available": false,
    "reason": "link-only"
  }
}