SOC II and other audits tend to come with the same baggage- they want strict roles and separation of duties between operations and engineering.