Category Compliance Management

Do you need the Privacy category, Confidentiality, or both? What each one requires, and how to decide without over-scoping your SOC 2.