These days, SOC 2 certification is seen as table stakes for SaaS startups. But it's only worth doing if the ROI will make up for the time and money you spend.