It’s a good list and I’ve referenced it a few times over the years. I misunderstood your intent on #5. I still think SSO is inappropriate because it’s going t

It’s a good list and I’ve referenced it a few times over the years. I misunderstood your intent on #5. I still think SSO is inappropriate because it’s going to bump you into enterprise tiers for random products when you need to be the most frugal with your burn. Going with 1Password or similar gets the job done. You 100% need SSO eventually and it does get harder to implement the longer you wait, but I still don’t think it’s worth it early. I think MDM is still a thing for SOC2, but my point is that most startups will not need a SOC2 immediately and folks should be mindful of what moves the needle security wise vs what auditors want.