You'll need to hire an auditor who will do an assessment. Usually pages and pages of questionnaires and high fees, the auditor will do everything remote. I've o

You'll need to hire an auditor who will do an assessment. Usually pages and pages of questionnaires and high fees, the auditor will do everything remote. I've only dealt with PCI-DSS but I assume it's similar. Questions like who has physical access to your servers, how often you change your wifi password, if you have antivirus software installed on your production servers. It's a huge time sink. I'd wait for at least the second or third request. Having the report is no guarantee that more companies will approach you.