Literally any firm can get a SOC2 Type 1, because there's no lookback to it; the Type 1 is a pinky swear.

In practice, if you're careful about how you do your Type 1, the Type 2 is almost as trivial. Your HR/bizops practice is much more likely to screw up and cause exceptions than anything you do in IT or engineering.