It's gonna depend on the auditor, but yeah of course SOC2 doesn't mean "you're secure" but unless you actively lie to your auditor you're going to have some basic stuff in place.