SOC 2
SOC 2 Type II (AICPA Trust Services Criteria). Published by AICPA, version 2017 TSC (2022 PoF). Kapālins maps it at category level: the assessment’s 3 AI-risk areas, each tied to this framework, rather than clause by clause. 2 of 3 risk areas are proved by a live signal from the platform, and 1 by the assessment.
Live signal: a signal from the gateway, probes or device sensor proves it continuously. Assessment: it is evidenced by answers to the assessment. Both are exported in the regulator evidence pack.
How SOC 2 got here.
- Adopted
The AICPA issued the Trust Services Criteria in their current form. EY To the Point
- Amended
The AICPA revised the points of focus for the 2017 Trust Services Criteria; the criteria themselves were unchanged. EY To the Point
- Guidance
AICPA SOC 2 guide updated as of this date for the revised points of focus and SSAE 20 and 21. AICPA & CIMA