https://cloudsecurityalliance.org/articles/why-do-soc-reports-have-to-be-issued-by-a-cpa-firm