The RSI security blog site breaks down the steps in some depth, but the method in essence goes similar to this: The difference between the different types of SOC audits lies during the scope and period of the evaluation: Every time cardholder knowledge is accessed, the party really should be https://www.nathanlabsadvisory.com/blog/tag/data-protection-impact-assessments/