Our SOC2 audit was mostly fine. The only “huh?” Moment I remember was when they asked me whether we used MFA, and then I proceeded to talk about how we have TO

Our SOC2 audit was mostly fine. The only “huh?” Moment I remember was when they asked me whether we used MFA, and then I proceeded to talk about how we have TOTP, WebAuthn, etc for our “2FA” as I happened to refer to it, and after talking for a minute about it, the auditor said, “just want to clarify, do you have any MFA configured”… at that point I realized how much they were just blindly marking checkboxes. So I just said “yes we do.”