Target Operating Model (TOM) Summary Checklist

Governance & Ownership

Product, platform, and security ownership defined
Clear accountability and escalation paths
Risk and vendor oversight managed centrally

People & Access

Role-based access control enforced
SSO with MFA supported
Least-privilege access applied
Joiner / mover / leaver process in place
Annual security awareness training

Processes

Documented SDLC and change management
Incident response and breach notification procedures
Periodic access reviews
Sub-processor oversight and disclosure
Defined data retention and deletion processes

Technology & Architecture

Multi-tenant SaaS architecture
Secure cloud hosting environment
Encryption in transit and at rest
Centralized logging and monitoring
Regular backups and recovery testing

Data & Information Management

Data types clearly defined and minimized
Logical tenant segregation enforced
Secure data export and deletion supported
Default data retention: 12 months (configurable)

AI & Automated Processing

Intended use of AI documented
AI used for research simulation only
No fully autonomous decision-making
Human review of outputs supported
Inputs and outputs logged and auditable
External AI providers disclosed
No customer data used for model training

Security & Compliance

SOC 2 Type II controls implemented
Information security and privacy policies maintained
Audit logging enabled
Vulnerability and dependency monitoring in place
ISO 27001: Not claimed

Monitoring & Incident Management

Availability and security events monitored
Incident response metrics tracked
Customer notification processes defined

Documentation & Review

Policies and procedures centrally maintained
Customer-facing security and legal documentation available
Evidence retained for audits and vendor reviews
TOM reviewed as part of SOC 2 lifecycle

This Target Operating Model is aligned to our SOC 2 Type II control environment and is reviewed regularly to ensure ongoing security, reliability, and compliance

Last updated 23 June 2025