Even when a five-person software startup and a multinational technology company both need SOC 2 compliance, and their obligations overlap, the tools they use don’t