“Unlike the PCI standard, SOC 2 does not have a prescribed list of specific controls, which makes it difficult for startups to implement without guidance.”