Information Systems and Controls (ISC) CPA Practice Exam 2026 – Your All-in-One Guide to Mastering CPA Success!

The correct answer is that additional criteria must be specified because trust services encompass a framework that evaluates various aspects of information systems, particularly in terms of confidentiality, availability, processing integrity, and privacy. Each of these areas has its own specific criteria that need to be met to ensure that an organization is adequately protecting sensitive information and maintaining effective controls.

Confidentiality requires measures to safeguard personal information from unauthorized access, which may include encryption and access controls. Availability ensures that systems are accessible when needed, requiring adherence to performance benchmarks and disaster recovery planning. Processing integrity focuses on the accuracy and completeness of data processing, necessitating error detection and correction measures. Lastly, privacy relates to how personal information is collected, used, retained, and disclosed, demanding strict policies and practices to comply with regulatory standards.

Each one of these areas requires tailored criteria that are more specific than just "common criteria," which means a generalized approach is insufficient. This specificity is critical to ensuring that the systems not only meet basic requirements but also adhere to best practices and regulatory demands in a comprehensive manner. Hence, specifying additional criteria goes beyond a blanket statement about common requirements, reinforcing the need for detailed, distinct controls aligned with each category.