Comment by hellcow

The reason we went with a company similar to Vanta (StrikeGraph) wasn't infosec. It was that SOC2 is enormous and spans beyond infosec, its controls and requirements are arcane, and having experts that have done this before set you up for success in your $50k, year-long investment to get to a Type 2 audit is hugely valuable.