I've been through the process before and just went through it again, and the first thing listed (Single Sign-On) is not required at all. I'm not even sure it's mentioned directly in the AICPA criteria.
I'm also not sure what SSO really buys you, except for just moving the criteria target to another SOC-2 report. ;)
Also, MDM is not really critical at all, as long as you have a solid/documented way of managing accounts on web and mobile apps.
I do like the rest of the article except for the list itself, however. SOC-2 is all about documentation and processes. Justifying your security choices is less important than carefully and fully documenting them, and the processes that you have in place.
I'm also not sure what SSO really buys you, except for just moving the criteria target to another SOC-2 report. ;)
Also, MDM is not really critical at all, as long as you have a solid/documented way of managing accounts on web and mobile apps.
I do like the rest of the article except for the list itself, however. SOC-2 is all about documentation and processes. Justifying your security choices is less important than carefully and fully documenting them, and the processes that you have in place.