I just purchased software for our company and they had both ISO 27001 and SOC 2 which made it way easier to deal with our security and governance team. They like to see those certifications. It would be possible without, but the scrutiny would be much higher.