The RSI security site breaks down the methods in a few depth, but the process in essence goes similar to this: The information protection authorities, Doing the job with each other in the eu Information Safety Board, ought to make sure the information security policies in the EU are applied https://www.nathanlabsadvisory.com/iso-20000-1-it-services.html