Map technical controls (MFA, peer review, encryption at rest, audit logging) to SOC 2 Common Criteria CC6, CC7, and CC8.