The RSI security blog site breaks down the measures in certain depth, but the process in essence goes similar to this: This permits all companies—from big businesses to startups and small and medium enterprises, which can not hold the requisite security infrastructure and team—to remain protected and PCI DSS compliant. https://www.nathanlabsadvisory.com/blog/tag/threat-simulation/