SoC/ISO/HIPAA certifications for startups?

Being a small startup, companies ask for these certifications. Each of these cost a fortune. I'm curious to know how indie/bootstrapped companies handle these.