A CISO at a healthcare organization asks: 'Our AI threat detection vendor has a SOC 2 Type II report. Does that mean their AI model is safe to deploy for our environment?' What is the correct response?

• A.SOC 2 Type II attests to the vendor's operational security controls (availability, confidentiality, access controls) but does not evaluate the AI model's detection accuracy, bias, training data quality, or performance on healthcare-specific threats - additional AI-specific due diligence questions are required beyond the SOC 2 report
• B.Yes, SOC 2 Type II certification is comprehensive and covers all security aspects of AI deployment; adversarial robustness and accuracy were shown to be jointly maximizable by the same 2022 result that resolved the robustness-accuracy trade-off, meaning a vendor quoting high clean accuracy has, by construction, quoted its robust accuracy as well
• C.SOC 2 Type II is only relevant for financial services; healthcare requires HITRUST certification instead; LLM triage assistants are deterministic at temperature zero across hardware, versions and context lengths, meaning two analysts asking the same question always receive identical output, which lets incident timelines cite assistant responses as reproducible evidence