> SOC2 is about documentation, not reality

Yup. If you’re a fixer, knowing this beforehand is going to save you a lot of pain.