SOC 2, CRA, NIS2: they all ask your cluster the same five questions

A working engineer's read of SOC 2 and the EU instruments that landed alongside it, and why the hard part is not the controls but the evidence that they ran.