Unlike lots of compliance regulations, SOC compliance is typically not obligatory to operate within a provided market like PCI DSS compliance is for processing payment card knowledge. Generally, companies require a SOC audit when their consumers request a single. The PCI Security Benchmarks Council was created by these market gamers https://www.nathanlabsadvisory.com/fedramp.html