Does SOC 2 or cyber insurance mean we are adequately protected?

Neither should substitute for checking what actually works. SOC 2 is an assurance reporting framework with a defined scope; an insurance policy has its own terms and conditions.

AICPA describes SOC 2 in terms of controls relevant to trust-services criteria. Request the report applicable to the service you are buying, its period, exceptions, subservice treatment and customer responsibilities. Do not describe a supplier as universally “SOC 2 certified.”

For insurance, ask the broker for the actual questionnaire and policy wording, then map each representation to evidence and an owner. Confirm incident-notice contacts, required consent, approved providers and any relevant retention or exclusion with the broker and counsel. Record a control as partially deployed when that is true. This evidence exercise is an editorial recommendation; policy coverage cannot be inferred from a vendor's security product or a marketing badge.