The RSI security site breaks down the steps in certain element, but the process in essence goes similar to this: The distinction between the different types of SOC audits lies from the scope and duration in the evaluation: Compliance with PCI DSS signifies a baseline of security, and is also https://www.nathanlabsadvisory.com/blog/tag/data-protection-impact-assessments/