A CISO at a healthcare organization asks: 'Our AI threat detection vendor has a SOC 2 Type II report. Does that mean their AI model is safe to deploy for our environment?' What is the correct response?

• A.SOC 2 Type II is only relevant for financial services; healthcare requires HITRUST certification instead
• B.Yes, SOC 2 Type II certification is comprehensive and covers all security aspects of AI deployment
• C.SOC 2 Type II attests to the vendor's operational security controls (availability, confidentiality, access controls) but does not evaluate the AI model's detection accuracy, bias, training data quality, or performance on healthcare-specific threats - additional AI-specific due diligence questions are required beyond the SOC 2 report
• D.The SOC 2 report is sufficient since it covers data handling for PHI under HIPAA requirements