SOC2 is also one of the weakest. >Developed by the American Institute of CPAs I don't know when CPAs became infosec experts. >Each company designs its own co

SOC2 is also one of the weakest. >Developed by the American Institute of CPAs I don't know when CPAs became infosec experts. >Each company designs its own controls to comply with its Trust Services Criteria. Because it depends on self-assertion, SOC2 is generally a weak organizational certification.