Use this checklist to prepare the discussion with your assessor, not as a substitute for the standard or an assessment. Readiness means knowing what is in scope, who operates each control, and how you will demonstrate that it works. Record gaps honestly so the assessment plan can account for them.
1. Confirm the payment environment
- Trace each payment channel from collection to processing, storage and deletion.
- Inventory systems that hold payment account data and systems that can affect their security.
- Document network boundaries, administrative access and third-party connections.
- Record outsourced services, relevant provider attestations and shared responsibilities.
- Confirm the required SAQ or ROC and AOC with the party requesting validation.
2. Build an evidence register
Create a register with a control reference, owner, evidence location, applicable period and review status. Policy documents explain the intended process; records, configurations and observations demonstrate its operation. Your assessor will determine the evidence and testing needed for each applicable requirement.
- Network security rules, configuration standards and change approvals.
- Data retention, encryption and key-management records relevant to the environment.
- User access approvals, access reviews, authentication settings and administrative account records.
- Vulnerability management, patching, development practices and security testing records.
- Logging, monitoring, incident-response exercises and personnel security awareness records.
3. Plan technical testing and remediation
Define the applicable scan and penetration-test scope before commissioning work. External ASV scanning, internal vulnerability scanning, penetration testing and segmentation testing serve different purposes. Confirm the required cadence and significant-change triggers against the standard and your assessment route. Where segmentation is used to reduce scope, retain evidence that the boundary works.
Keep a remediation register that records each finding, its owner, target date and retest result. A planned fix is not the same as an implemented control. Ask the assessor how a proposed alternative will be evaluated rather than assuming every unresolved finding can be addressed through a compensating control.
4. Review e-commerce payment page security
For browser-based payments, describe how the checkout is implemented: redirect, embedded payment form, or merchant-controlled payment processing. Record scripts and dependencies that could affect payment security. Match that implementation to the applicable assessment requirements and eligibility criteria rather than copying another merchant’s questionnaire.
The revised SAQ A removed specific payment-page control questions and introduced script-security eligibility criteria. This change did not delete the underlying requirements from PCI DSS. Consult the current SAQ A and PCI SSC FAQ 1588 to determine how your implementation meets eligibility; do not assume an outsourced payment form resolves every risk.
5. Keep compliance working after the report
- Maintain a calendar for recurring control reviews, scans, tests and training.
- Assign an owner to identify changes that may affect scope or require additional testing.
- Review provider responsibilities when integrations or contracts change.
- Retain operating evidence throughout the period instead of recreating it before the audit.
- Agree how findings, incidents and exceptions are escalated to the compliance owner.
Ask 443 Labs to review your scope and readiness before committing to an assessment date.
Get in TouchOfficial sources
Related Services
