Yes it’s a huge racket that’s likely does little to solve the problems it was enacted to prevent. But have you tried making deals with large SOC2 companies without your own certification?

Having gone through ISO 27001 and PCI DSS level 2 I kind of assumed all of these security focussed compliance standards are just that. Anyone have any exceptions?