How does SOC2 persist when everybody knows that nobody takes it seriously at any step of the process?