If I do SOC2, then I have to spend a lot of money.
If I don't, then my customers will forgive me in a few weeks and life goes on.
If I don't, then my customers will forgive me in a few weeks and life goes on.
Also, it can help get you out of repeat security assessment questionnaires, so it can actually give you time back, depending on how many of those you have to field.
Of course if you are in an industry were clients don't ask for soc2, don't do soc2.
And it's a good question whether you want such larger clients at all. At one of the previous places where I worked, we used to put deliberately bad answers (the worst that our public version of the security policy would allow, not the actual practices) in security forms in order to get rid of too-demanding clients.
That seems like quite a waste of time. Nobody forces you to take on a customer, so if you don't want them just say no and move on, instead of spending a lot of everyone's time to go through the motions hoping for the deal to break.
... Which is not a good thing, because (as noted already in this thread) SOC2 doesn't actually make you secure. Nor does not having certification make you insecure. But, when used as a shorthand, it leads companies to engaging in compliance theater to get certified, spending a bunch of money without actually making their data noticeably more secure.
If you don't, you are missing out on a lot of customers who would have given you 10000x the one-time cost of SOC2.