SOC-2 is best thought of as a basic soundness check on the cybersecurity stance of an organization. The very pessimistic way to think of it is it is a check on

SOC-2 is best thought of as a basic soundness check on the cybersecurity stance of an organization. The very pessimistic way to think of it is it is a check on sufficient documentation being in place to keep things running if everyone in DevOps/Security is outsourced overnight. Adages about being able to ISO 9001 certify a cement life jacket ^H^H^H SOC-2 certify an Open S3 bucket remain true, but there is a certain amount of deliberate intent required on both sides to complete the process. In other cases it can be used as an excuse to give security _some_, much needed reason for funding and effort. Consider the people who cannot handle a SOC-2 audit. They exist, they walk among us and get funding.