Not sure I agree. It might sound like theater if you expect it to solve your security issues. But it is extremely good at finding undocumented or broken processes - these processes tend to hide the biggest offenders.
I kinda agree, I won't pretend it's otherwise. But I do believe, that particularly now, it's important to keep the bare minimum. And some aspects of managing compliance are kinda useful (like checking that you have a lot of backups, but no decryption key).
SOC 2 is security theater. You're selling shovels for a fake gold rush.
Not sure I agree. It might sound like theater if you expect it to solve your security issues. But it is extremely good at finding undocumented or broken processes - these processes tend to hide the biggest offenders.
I kinda agree, I won't pretend it's otherwise. But I do believe, that particularly now, it's important to keep the bare minimum. And some aspects of managing compliance are kinda useful (like checking that you have a lot of backups, but no decryption key).