This isn't performed by auditors; it is finished from the databrackets group to find out the gaps within the process. This offers them pretty certain suggestions of controls they have to design and put into action. If an organization promises that they are SOC 2 Compliant, it demonstrates their ability https://www.nathanlabsadvisory.com/blog/nathan/the-benefits-of-vulnerability-assessments-and-penetration-testing-services-in-the-uae/