I'm pretty sure that's not what the author meant. Again: those are things you should do regardless of whether you're ever going to get SOC2 (and a lot of startups shouldn't).

That and having a ticket system (e.g., Jira) to track why you touched prod and you can answer just about every question.

We don't have that, and didn't need it for SOC2.

(We have other ways of tracking prod changes, but our auditors don't know anything about them.)