SOC 2 penetration testing: where it fits in the Trust Services Criteria, what auditors expect in the report, and how often to run it.