>No one who has ever actually had to do SOC2 compliance

while i find tptacek's opinions very strong on the subject, you would be extremely mistaken to think those opinions were formed without experience