[Grimburger]

You have it completely the wrong way around.

HIPAA is self-certifying, SOC2 isn't.

No way on earth you are getting SOC2 without an auditor.