The RSI security blog breaks down the measures in a few detail, but the process in essence goes like this: Select a compliance automation software Device to avoid wasting time and cost. Professional suggestion- decide on a licensed CPA company that also provides compliance automation software for an all-in-one solution https://www.nathanlabsadvisory.com/blog/nathan/stay-one-step-ahead-advanced-penetration-testing-solutions/