Where would an assessor start?

Choose a standard.

• SOC 2Trust services criteria, usually demanded by enterprise buyers during procurement.
• ISO 27001A certified information security management system, and the evidence that it runs.
• PCI-DSSRequirements that apply once you store, process or transmit cardholder data.
• GDPRObligations that attach to personal data, wherever the people are.