We are working toward SOC 2 Type II. The preparation has already paid for itself in ways we did not expect, and it changed how we build the product.
A verified identity on an unpatched laptop is still a problem. The four posture checks worth enforcing, and how to roll them out without a help-desk flood.