The RSI security weblog breaks down the steps in certain detail, but the method in essence goes such as this: Your business is service service provider primarily based exterior the EU. It offers services to customers outside the house the EU. Its clients can use its services after they travel https://www.nathanlabsadvisory.com/3rd-party-security-audit-assessment.html