SOC 2

…Patrick Spencer (24:09.553) So that's a good segue when you're talking about the being compliant with different regulations, whether it's SOC 2 or it's ISO, your NIST lists, the NACD that you talked about.…

…So a lot of the organizations, you know, if you kind of look at the journey of a up and coming company, right, they start out with a SOC 2 attestation, we kind of joke that's the gateway drug to compliance.…

…So starting with SOC 2, so while SOC 2 wasn't originally designed for AI-specific risks, It covers security, privacy, availability, confidentiality, and processing integrity, which are critical for AI governance.…

…If a service organization is using AI and they're, you know, casting output that's going to have an impact on either financial reporting or in a SOC 2, their service level commitments, then it's important that they're able to demonstrate with maturity around these basic safeguards and some of the governance and risk elements of AI in order to ascertain confidence…

…I think if you look at how we came to a compliance journey, really, SOC 2 was written in the late 20 noughties.…

…You know, you look at ISO certifications, whether it's ISO 27001 for security, 42001, you know, for AI governance, SOC 2 properly designed to take into account, you know, the AI systems and the risks that are predicated there, both from a, a workflow perspective, a tactical risk management perspective, and a governance perspective becomes…

…And so there are oftentimes where our customers may ask for a SOC 2 as an example, a security artifact that's important for their internal third-party management process around third-party governance.…

…So not doing the audits, but actually doing, uh, implementations and consulting engagements to help companies to comply with a variety of, uh, you know, primarily information security frameworks, so SOC 2, ISO, NIST, that kind of thing.…