Compared with many compliance restrictions, SOC compliance is often not mandatory to operate in the given business like PCI DSS compliance is for processing payment card info. In general, organizations require a SOC audit when their clients request 1. Use powerful cryptography when transmitting cardholder data across open, public networks. https://www.nathanlabsadvisory.com/ccpa.html