There's no particular reason anyone's SOC2 DRL would cover "make sure people don't email credentials". It's not a technical certification.