SOC 2 Compliance for AI Agents
SOC 2 Type II evaluates controls over time across five Trust Service Criteria. Agentic AI creates new control areas that traditional audit systems do not cover — EMET fills this gap by providing AI-specific audit trails and monitoring that map directly to SOC 2 requirements.
EMET supports evidence collection for key Trust Service Criteria:
- CC6 — Logical and Physical Access Controls — Role-based access control, SSO integration, authentication logging, user lifecycle management, and monitoring of every command executed by AI agents
- CC7 — System Operations — Continuous security-rule evaluation as events arrive, anomaly alerting, and tamper detection on the EMET sensor itself
- CC8 — Change Management — Capture of every file modification made by AI agents, with session context linking changes to specific prompts and AI decisions
- CC9 — Risk Mitigation — Visibility into third-party developer AI activity in your repositories
Evidence packages for SOC 2 audits include:
- User access lists with roles, status, and last login
- Security alert history with resolution notes and investigation outcomes
- Alert rule configuration documentation
- Filtered event exports for change management (Write/Edit tool events)
- Session timelines for incident response review
For a broader view of EMET's compliance support, see the Compliance Overview. EMET also supports HIPAA, GDPR, and ISO 27001 evidence collection.
:::info Available on Pro and Enterprise Plans
Detailed SOC 2 compliance documentation, including trust service criteria mappings, evidence collection step-by-step guides, recommended controls checklists, and auditor-ready export instructions, is available to EMET Pro and Enterprise customers within the dashboard.
Sign in to your EMET dashboard →
:::