SOC 2 Type II

A Type II examination watches a control operate across weeks, so evidence has to be continuous. This starter frames AI traffic for that review and adds fields for change control, risk assessment, retention and monitoring. Operating effectiveness is a conclusion your auditor reaches, not something a configuration delivers.

Behavior over months is the subject, not design on a day. An auditor samples a period and asks whether a control worked the same way at the start and at the end. That shifts your effort toward keeping records unbroken.

Change handling and risk work appear as areas here for that reason. Every edit to the chain becomes a change with an owner, a reason and a date. Sampling will find a week where a threshold moved and nobody wrote down why.

The evaluated stages match the ones that ship with the point in time starter. Requests pass injection screening, identity enforcement, national identifier redaction, and a block list for passwords, private keys and access tokens. Responses must reach 0.85 combined, with relevance at 0.78 and accuracy at 0.80.

A short answer fails the same gate, because the floor asks for at least 120 characters and two sentences. Nothing pauses for a person in this configuration. Add a review step when your description of the system promises one.

Continuous evidence is the hard part, and it belongs to you. Keep the record of each evaluated request, watch for drift, and note every exception with a remediation date. The closing stage marks requests and holds nothing back, and it retains nothing for you.