Yes, it’s compliance that forces the behavior. Another reason SOC2 is mostly worthless.