Contrary to lots of compliance polices, SOC compliance is typically not mandatory to function within a given market like PCI DSS compliance is for processing payment card data. Generally, providers have to have a SOC audit when their customers request 1. Your business is service supplier centered outside the EU. https://www.nathanlabsadvisory.com/blog/tag/threat-simulation/