Likely the most nerve is the QSA is collecting data for the Report and is onsite. The report will include all the checks that are in place, not in place, or planned\/comments. The ROC includes these sections: Executive Summary – Description of Scope of Work and Approach Taken – Details about Reviewed Environment – Contact info and Report Date – Quarterly Scan Results – Findings and Observations – Compensatory Controls Worksheets – Section is the substance of the report, demonstrating compliance to the 12 demands. Section 5 is the external scan results from the ASV. Looking ROC Reporting Instructions for PCI DSS v2 can further analyzes facets of each section.

QSAs for report creation mostly utilizes the document, but will help the what of report and how production is understood by merchants. Within their QSA solutions supplies insights on how firms perform during 27, the Verizon Communications 2011 Payment Card Industry Report produced. PCI demands for associations 10, 3, 11, and 12. Most frequently implemented quite easily were: 4, 5, 7, and 9 – Only 21% of associations were fully compliant on the Initial assessment. Among the lowest implemented requirements .12, is probably one of this root causes of other demands not meet the mark. Organizational business units aren’t likely to follow what’s not explicitly stated and referenced internally. Merchants may benefit from sending the staff to training conducted by the standardization board, called Internal Security Assessor.