As opposed to lots of compliance restrictions, SOC compliance is usually not mandatory to operate in the presented industry like PCI DSS compliance is for processing payment card info. Generally speaking, companies need a SOC audit when their prospects ask for just one. SOC 2 is actually a security framework https://www.nathanlabsadvisory.com/news.html