The RSI security website breaks down the actions in a few detail, but the procedure in essence goes like this: Find EU policies designed to convey Added benefits to citizens, organizations along with other stakeholders in the EU The PCI SSC has outlined 12 specifications for dealing with cardholder details https://www.nathanlabsadvisory.com/vapt-services.html