Fortune 500 client demanding SOC 2 compliance for our CTV campaigns - what's the deal?

Just landed a potential Fortune 500 client who's interested in our CTV strategy but their procurement team is asking if our platform has SOC 2 Type II certification. Honestly never dealt with this before since most of our clients are mid-market D2C brands.

They're saying it's non-negotiable for any vendor handling their customer data or campaign management. Is this becoming standard for enterprise CTV buys? What exactly does SOC 2 cover that regular privacy policies don't?

Anyone else running into compliance requirements like this when pitching larger brands? Trying to figure out if this is worth pursuing or if we should stick to our usual client size. The media spend would be massive but don't want to get in over our heads with enterprise security requirements.