An auditor is evaluating the 'Processing Integrity' criterion in a SOC 2® engagement. Which of the following is a key requirement?

System is available for operation and use as committed or agreed.

Information is protected from unauthorized disclosure.

System processing is complete, valid, accurate, timely, and authorized.

Personal information is collected, used, retained, and disclosed in conformity with commitments.