I went through SOC2 Type I and II. I’d say that most of that stuff is necessary, like splitting environments and so on. That doesn’t mean it’s anything close to sufficient to avoid being hacked.

It’s a framework to give you the direction, then if employees are careless (or even malicious), no security standard is complete enough to protect a company.