https://www.pivotpointsecurity.com/podcasts/ep3-dan-schroeder-iso-27001-vs-soc-2-which-attestation-is-right-for-you/