SOC2 is an industry self-governing standard and a really bad example? if you pass SOC2, do you pass a federal audit of HIPAA and PII compliance? there's industry self-regulation that's often pointless and a costly rubber-stamp (like SOC2) and then there's actual audits of systems with legal teeth
if anything, your example serves to prove my point. for everything from baby formula regulatory standards to regulation of toxic pollutants being dumped untreated into water reserves, I'd much rather a robust, regulatory standard with teeth. for things in software, we're sorely lacking that which is why we have privacy breaches and gross misuse by large corporations on the regular not to mention dark patterns, behavioral manipulation, and outright gambling
if anything, your example serves to prove my point. for everything from baby formula regulatory standards to regulation of toxic pollutants being dumped untreated into water reserves, I'd much rather a robust, regulatory standard with teeth. for things in software, we're sorely lacking that which is why we have privacy breaches and gross misuse by large corporations on the regular not to mention dark patterns, behavioral manipulation, and outright gambling