When retailers sign a contract which has a payment processor, they agree to be matter to fines when they are unsuccessful to maintain PCI DSS compliance. The difference between the different types of SOC audits lies from the scope and length of the evaluation: For those who combine with Stripe https://www.nathanlabsadvisory.com/blog/nathan/stay-safe-with-premium-penetration-testing-services-in-uae/