SOC 2: controles y responsabilidades
Conozca obligaciones, controles técnicos y responsabilidades organizativas.
SOC 2: controles y responsabilidades · Marco voluntario
Esta página explica controles AI-FW sin reemplazar las responsabilidades de cumplimiento o auditoría.
Dónde encaja AI-FW
- Nota: Depending on configuration, AI-FW records authentication, decisions, changes and model traffic observed by the gateway. It does not produce an SOC 2 report.
Lo que el producto no hace
- Nota: Defining SOC 2 scope or system description.
- Nota: Operating organisational controls outside gateway.
- Nota: Guaranteeing Type I or Type II.
- Nota: Proving period-long effectiveness alone.
- Nota: Replacing independent CPA examination.
Controles relacionados
- Nota: Logical access: Nota: Restrict access and manage credentials. AI-FW: Nota: Authentication, roles and revocable keys/certificates.
- Nota: Change management: Nota: Authorise and record changes. AI-FW: Nota: Audit Events for rules and configuration.
- Nota: Monitoring: Nota: Detect activity and maintain records. AI-FW: Nota: Transactions, Activity views, risk signals and export.
- Nota: Processing: Nota: Process according to commitments. AI-FW: Nota: Guardrails and model/destination policies.
Evidencias
- Nota: Identity: Nota: Modes, roles and authenticated calls.
- Nota: Policy changes: Nota: Actor and time.
- Nota: Activity: Nota: Transactions and risk signals.
Responsabilidades de la organización
- Nota: Define service scope and criteria.
- Nota: Operate organisational controls and oversee subservice providers.
- Nota: Provide evidence beyond AI-FW records.
- Nota: Coordinate CPA tests and remediation.
- Nota: Do not present product evidence as a SOC 2 report.
Preguntas frecuentes
Nota: Does AI-FW provide our SOC 2 report?
Nota: No. Ask commercial channels about provider materials.
Nota: Are gateway logs enough?
Nota: No. Organisational controls and evidence are required.
Nota: Do logs prove Type II?
Nota: No. Type II requires period evidence and independent assessment.
Información general, no es asesoramiento legal ni de auditoría.