SOC 2
SOC 2 AI control mapping.
TrustScope provides strong evidence coverage for monitoring, control activity, and change-management criteria tied to AI runtime behavior.
Last verified mapping date: February 19, 2026
| Control | Requirement | Status | TrustScope Evidence |
|---|---|---|---|
| CC4.1 | Monitoring activities | Ready | Continuous detection logs and alert history |
| CC5.1 | Control activities | Ready | Policy evaluation and enforcement receipts |
| CC5.2 | Technology controls | Ready | Runtime guardrail and budget policy execution logs |
| CC6.1 | Logical access | Partial | TrustScope RBAC + customer IAM evidence needed |
| CC6.2 | Access provisioning / deprovisioning | Partial | Customer identity lifecycle controls required |
| CC8.1 | Change management | Ready | Configuration history and policy version trails |
| CC9.1 | Risk mitigation | Ready | Exposure scoring, incidents, and response timelines |
| CC9.2 | Vendor management | Customer | Organizational process outside TrustScope scope |
Evidence, not compliance determination
TrustScope provides governance evidence, not compliance determinations. SOC 2 conclusions require qualified audit review.