SOC 2 is not an AI framework, which is exactly the problem. Your auditor scopes the systems that touch customer data, and AI systems increasingly do — while sitting outside the change management, access control and logging story the rest of the estate has. UrNammu seeds all 20 Trust Services Criteria and attaches them to the AI systems, agents and API keys in the registry, so the AI half of the environment produces the same evidence as everything else.
Coverage across all four frameworks, with SOC 2 criteria inheriting from AI-framework work
Seeded criteria, by category
Common criteria
9CC1–CC9: control environment, communication, risk assessment, monitoring, control activities, logical and physical access, system operations, change management and risk mitigation.
Availability
1A1, covering capacity, backup and recovery commitments.
Confidentiality
1C1, covering how confidential information is identified, protected and disposed of.
Processing integrity
1PI1, covering complete, valid, accurate and authorised processing.
Privacy
8P1–P8: notice, choice and consent, collection, use and retention, access, disclosure and notification, quality, and monitoring and enforcement.
How UrNammu covers it
CC6 access control, including the keys
Role-based access across Admin, Compliance Officer and Viewer, plus key usage rules that catch a leaked or misused API key by how it behaves rather than waiting for someone to report it. Shadow AI discovery finds the AI tools nobody put through access review in the first place.
CC8 change management for AI systems
Systems move Draft to Under Review to Approved to Deployed to Retired with staged Owner, Security, Legal and Compliance sign-off and a recorded rationale at each gate — the authorisation trail CC8 asks for, on the assets most likely to be missing one.
CC4 and CC7 monitoring that already exists
Every mutation writes an audit log entry linked to the user and the entity. The proxy records model calls, tool use and policy decisions, alerts land in one inbox across every governance signal source, and the Policy Denials log is a standing record of controls operating rather than merely existing.
C1 and P-series, enforced in traffic
Inline DLP inspects live proxy traffic in both directions for secrets, exfiltration attempts and pasted sensitive data, and scheduled probes test your AI gateways for system-prompt, credential and PII leakage. Confidentiality and privacy criteria get tested behaviour, not just a policy document.
Frequently asked questions
Does UrNammu replace our SOC 2 compliance platform?
No. Vanta, Drata and their peers cover the whole organisation; UrNammu covers the AI estate they have no visibility into — which AI systems exist, who approved them, what the agents are allowed to call, and what actually went through the proxy. Use it as the AI evidence source feeding your existing SOC 2 programme.
Why seed SOC 2 in an AI governance tool at all?
Because of the crosswalk. The seeded catalog carries 107 curated links, so an assessment recorded against an ISO/IEC 42001 Annex A control or a NIST AI RMF category can inherit to the matching Trust Services Criteria instead of being evidenced twice.
Which criteria does it cover?
All 20: the nine common criteria CC1–CC9, plus A1 availability, C1 confidentiality, PI1 processing integrity and the eight privacy criteria P1–P8, using the 2017 Trust Services Criteria identifiers.
Can we hand the output to an auditor?
Reports build from templates, export to PDF, CSV or JSON, and can be scheduled to land in an auditor’s inbox on a cadence. Coverage rolls up per system and across the estate, and every assessment links to the evidence artifacts behind it.
UrNammu is governance software, not legal advice. Control mappings and derived risk tiers are inputs to your own legal and compliance review.
Other frameworks
EU AI Act
Classify each AI system’s EU AI Act risk tier, derive the obligations that follow, and evidence them control by control against 19 seeded articles.
EU AI Act Compliance Software →NIST AI RMF
Operationalise the NIST AI Risk Management Framework: 19 seeded controls across Govern, Map, Measure and Manage, assessed per system with evidence.
NIST AI RMF Software →ISO/IEC 42001
Run an ISO/IEC 42001 AI management system on real data: 38 seeded Annex A controls assessed per system, with evidence, coverage roll-ups and an audit trail.
ISO 42001 Compliance Software →