They are not checking if your systems are, say, vulnerable to a SQL injection attack. Take a look at http://www.webtrust.org/homepage-documents/item54279.pdf h

They are not checking if your systems are, say, vulnerable to a SQL injection attack. Take a look at http://www.webtrust.org/homepage-documents/item54279.pdf http://www.webtrust.org/homepage-documents/item54279.pdf and say, a typical CPS https://www.digicert.com/wp-content/uploads/2017/01/DigiCert_CPS_v4112.pdf https://www.digicert.com/wp-content/uploads/2017/01/DigiCert... They do an audit to check if all practices and procedures follow these guidelines.