As A part of PCI information security benchmarks, Actual physical cardholder facts have to even be saved inside of a secure spot, like a locked area or storage location with restricted accessibility. The distinction between the different types of SOC audits lies during the scope and length with the assessment: https://www.nathanlabsadvisory.com/data-protection-officer-service-virtual-dpo.html