Many customers have asked how to know which Infrastructure provider to connect to Drata (if you use multiple). We consulted with our auditor partners, and you will want to consider first, where your customer data is stored. Typically SOC 2 only looks at production systems and excludes non-prod environments.

The exception would be is if the Dev environment is where developers are writing and storing their code, if so you would need to look at that environment for your audit as well to ensure access to source code was locked down.