Is a penetration test required for SOC 2? (What isn’t mandatory might still be required)