[tptacek]

They're 100% right, substantively, about how they're satisfying their SOC2 control requirement here. I'd be alarmed and skeptical of any security practice that was led by compliance requirements.