Guide
PCI assessment evidence, by type
PCI assessment evidence comes in four forms: documents, records, interviews and observations. The QSA combines them for each requirement, so gaps in any one form slow the assessment.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
The four kinds of PCI assessment evidence
Documents show what you intend, such as policies and procedures. Records show what happened, such as review logs. Interviews and observations show how people actually work.
So the QSA usually checks more than one form per requirement. Because they must agree, a policy that nobody follows becomes a finding.
| Type | Examples |
|---|---|
| Documents | Policies, procedures, diagrams |
| Records | Logs, tickets, review sign-offs, scan reports |
| Configuration | Settings exports and screenshots with dates |
| Interviews | Owners describing how a control runs |
| Observation | QSA watching a process happen |
Labeling PCI assessment evidence
Name each file with the requirement number and date. Then the QSA traces it quickly. Also keep one index per folder.
In addition, export reports with visible filters and timestamps. Undated screenshots often trigger follow-up requests.
PCI assessment evidence check
Tick what your evidence file already does.
Your result appears here as you tick, so you can see what is still open.
Samples and populations
The QSA samples items such as user accounts, changes and systems. So keep complete lists ready. A missing item in the list can undermine the sample.
Then pull the records for each sampled item quickly.
PCI assessment evidence from service providers
Some requirements are met by your providers. So collect each provider's AOC and the responsibility matrix. Then show how you monitor them under 12.8.
Because these depend on other companies, request them early.
Keeping PCI assessment evidence
Keep evidence for at least the assessment period, and as long as your policy states. Also retain audit logs as requirement 10 sets out.
As a result, next year's assessment can compare against this year's file.
Where Ashcroft helps
We set up the evidence structure and check files before the QSA sees them. Our gap analysis fee runs $8,000 to $40,000, and policy and documentation work runs $10,000 to $30,000. We are not a QSA. The standard is in the PCI SSC document library.
PCI assessment evidence questions
How much PCI assessment evidence is enough?
Enough for each requirement in scope, in the forms the QSA asks for.
Can PCI assessment evidence be screenshots?
Yes, if dated and clear. Exports are often better.
Who keeps PCI assessment evidence?
Each control owner, with a coordinator keeping the index.
Do interviews count?
Yes, alongside documents and records.
Related guides
Organize your PCI assessment evidence
Tell us your scope and last assessment date. We reply with a written estimate, usually inside one business day.
Get my written estimate