OMB Cloud started the implementation of the full SOC 2 Type II control set: documented change management, quarterly access reviews, vendor risk register, formal incident-response runbook, encryption-at-rest verification and continuous logging. Audit window opens late 2026.
Published: December 12, 2025.