This is mostly true with security compliance in general from my experience. SOC II, for instance, is pretty straightforward if you were already doing things in

This is mostly true with security compliance in general from my experience. SOC II, for instance, is pretty straightforward if you were already doing things in a sane way. It’s only a lot of work if you were previously sloppy with security and need to rectify that