SOC 2 does not prescribe a set number of controls. Instead there are a number of requirements which can be met by as many or as few controls as your company needs.