Comment by Alexsky2

I agree that regulatory compliance and industries around that can often be theater and it creates regulatory barriers that inhibit startups and competition generally but there must be some method of oversight to ensure that people can trust a system or company without needing to see the internals. For example, we trust our food is healthy because the firm that made it is authorized to do so by the FDA as they comply with the rules established by those regulators. Obviously there are flaws, loopholes, etc, and obviously software is different than health but to an extent we want some guarantees from an externally trusted actor. What is needed in the current SOC2 world that might solve some of the issues you outlined without getting rid of it, or the idea of it, entirely?