Contrary to a lot of compliance polices, SOC compliance is typically not mandatory to operate inside a provided marketplace like PCI DSS compliance is for processing payment card information. Usually, companies have to have a SOC audit when their prospects ask for a person. Go with a compliance automation software https://www.nathanlabsadvisory.com/eu-gdpr.html