To be fair this is the same as most regulatory bodies. You have specific things you must do for SOC2. There can also be known issues that you must document and, as long as they fall within acceptable risk tolerances and you have a plan to fix them within some defined time period, it can be acceptable (obvs, again, depending on the risks).

It's not perfect, but then again... nothing is. Personally I think that being honest about all risks, documenting them, and having a plan in place to fix things is a good place to be.

Of course, FAA, aviation, space, healthcare etc. should have much lower tolerance to risk, so you'd expect that the portion of these that can be ignored should be very low risk.