The company I'm working for is about the undergo PCI compliance onsite assessment. The PCI DSS has a kind of checklist, but it is all very vague and abstract to me. So I'm not quite sure what I need to have prepared for the QSA, when he comes.

More specifically, I'd like to know what exactly the QSA asks for in terms of documents, software, configuration files, scripts etc. In the case of documents, how detailed should the information be? Just general guidelines or specific procedures for each item?

For example, is it acceptable to write only something like this on my policy document?

Procedures must include periodic media inventories in order to validate the effectiveness of these controls.

Or should I provide details about what these procedures are, who will perform them, how long is the mentioned period, etc?


2 Answers 2


That depends on several things. Unfortunately, the PDI DSS is a bit vague in some areas, and different auditors interpret things differently. Expect your first audit to by 80% figuring out what you need to prepare, 20% actually getting it together, and then expect future audits to go more smoothly. But your QSA will tell you what he/she expects.

In general, though, you should have written polices for how you protect your data (backups, live, etc) and be able to produce logs and evidence that shows that you follow procedures.

For example, to satisfy section 6, developers need to have a documented development process. We do, and our process includes steps like code reviews (so we provide copies of completed code reviews) procedures for asking admins to publish a specific tagged item from source control to address separation of concerns (so we provide change request tickets that specify which version of source code gets published on what date/time).

The same goes with the rest of the audit. Have your procedures documented, and provide proof that you follow those procedures.

As for how detailed the policies should be, you should build your paper trail into the policies, so that the auditor knows what to expect for documentation, and so that you force yourself to collect the documentation throughout the year. It makes things a LOT easier. Include things in your polices like "All changes are logged in (name a system)" and then actually log your changes in that system.

Odds are, your current practices won't 100% meet the requirements, or you won't be able to provide that documentation. Generally that seems to be expected on a first audit (or so I gather from our auditors) and the first audit is sort of an eye-opener. It teaches you where you need to improve your polices (and improve them right now). You will likely have the opportunity to provide what you have, and start drafting new policies under the guidance of your auditor. In subsequent years, expect less leniency.


This is a common question. It is helpful to know exactly what the QSA has to attest to as required by the PCI council. Use the following document as your guide:


You will see that the instructions for the QSA are very specific and these are the things he will be looking for. The "ROC Reporting Details" column will provide almost exact verbiage for items that need to be found in your policies as well as items he will need to verify. The policies are your responsibility to prepare before he arrives but he will ask you to show him anything else that is required for his validation. Of course if he is a good QSA he will clarify all of this for you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .