3 ms·

I am NOT well versed (so standard disclaimers apply :) but https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/

I am NOT well versed (so standard disclaimers apply :) but https://latacora.micro.blog/2020/03/12/the-soc-starting.html https://latacora.micro.blog/2020/03/12/the-soc-starting.html says that SOC2 is (mostly) about sales and little about validating security practices, only that you have them. I find it telling that SOC2 audits are performed by accountants.

throwaway201103 6y ago
Even a financial audit is based on what the company tells the auditors and is about whether the financial reporting conforms to generally accepted principles, not whether it's actually correct.