SOC 2 Vulnerability Scanning: What CC7.1 and CC7.2 Actually Require

Most startups hit the same wall. You're halfway through your SOC 2 audit, and the auditor asks for vulnerability scanning evidence. You've been heads-down on access controls, encryption, HR policies.