Comment by devy

Is this how every auditor does though or just you/Deloitte? SOC 2 is a set of guidelines, not mandates, there is one size fits all and every org may design their own security controls based on their unique systems. Is that the same philosophy on the auditing side as well?