As someone who has done a number of soc2 audits this is pretty solid advice.