01
Project Initiation
Agree stakeholders, responsibilities, milestones, communication routes and the formal assessment scope.
PCI DSS Report on Compliance
Prepare for Your PCI DSS Report on Compliance Without Leaving the Hard Questions Until the Audit
A Report on Compliance is a detailed record of a PCI DSS assessment. The fastest route to a defensible RoC is to resolve scope, evidence and control weaknesses before they become late-stage assessment issues.
2-sec supports the journey from scope definition and document collection through QSA-led assessment, remediation of open items, quality assurance and final reporting.
Formal PCI Validation
An RoC Documents the Detailed Results of a PCI DSS Assessment
A PCI DSS Report on Compliance is the reporting tool used to document the detailed results of a PCI DSS assessment. Whether your organisation must use an RoC rather than an SAQ is determined by the compliance programme and the entity accepting your compliance evidence.
For organisations on the RoC route, preparation matters. Scope ambiguity, incomplete evidence, untested controls or unresolved findings can slow the assessment significantly. A structured readiness process reduces that uncertainty before the reporting work reaches its final stages.
RoC Assessment Support
Structure the Assessment Before the Evidence Starts Arriving
2-sec's historical PCI methodology separates the work into scope, evidence mapping, onsite or remote assessment, remediation and final quality assurance.
02
Scoping Evidence
Collect payment flows, network and data-flow diagrams, inventories and other primary scoping records.
03
Policy and Procedure Mapping
Review governance documentation and map policies and processes to applicable PCI DSS requirements.
04
Control Validation
Assess technical and operational controls through evidence review, interviews, observation and required testing.
05
Open-Item Remediation
Track assessment gaps and support the organisation in resolving items that can be remediated during the validation period.
06
RoC Finalisation
Complete the assessment record, quality-assurance review and required attestation documentation.
RoC Readiness
What Usually Determines Whether an RoC Runs Smoothly
Most friction comes from unresolved fundamentals, not from the report template itself.
Defensible ScopeThe CDE and connected-to systems are clearly documented and understood.
Current EvidencePolicies, configurations, logs and recurring-control records are available for the assessment period.
Stakeholder AvailabilityControl owners can explain how requirements operate in practice.
Testing CompleteRequired vulnerability scans, penetration tests and other security tests are available and current.
Third-Party EvidenceRelevant TPSP responsibilities and compliance evidence are understood.
Open Findings ManagedKnown issues have owners, remediation activity and evidence of closure.
Requirement ApplicabilityAny N/A or customized-approach decisions are supported and documented.
Assessment GovernanceEvidence requests, interpretations and decisions are tracked consistently.
How 2-sec Approaches It
From Kick-Off to Final Report on Compliance
01
Kick Off and Scope
Confirm stakeholders, reporting expectations, scope and assessment plan.
02
Collect and Map Evidence
Gather scoping records, policies, technical artefacts and requirement-level evidence.
03
Perform Assessment Activity
Validate controls through interviews, observation, evidence review and technical testing where applicable.
04
Manage Remediation
Identify and work through open assessment items that require correction or additional evidence.
05
Quality Assurance
Review the assessment record for completeness and consistency.
06
Finalise RoC and Attestation
Complete the reporting package required by the compliance programme.
A good RoC process starts long before the final report is written.
Discuss Your RoC Assessment ↗RoC Questions
Frequently Asked Questions About PCI DSS Reports on Compliance
Who needs a PCI DSS Report on Compliance?
The relevant compliance-accepting entity determines whether an organisation must validate with an RoC, an SAQ or another reporting method under its compliance programme.
Is an RoC the same as an Attestation of Compliance?
No. The RoC is the detailed assessment report. The Attestation of Compliance is a separate PCI SSC form associated with the assessment result.
Can we use SAQ eligibility criteria to decide which requirements go into an RoC?
Not by default. PCI SSC states that SAQ eligibility criteria should not be used as a guide for determining RoC applicability unless that approach has been explicitly reviewed and agreed with the compliance-accepting entity.
Can remediation happen during an RoC assessment?
Some open items may be remediated during an assessment, depending on the circumstances and the reporting programme. It is still more efficient to identify major gaps in a readiness phase before formal assessment activity is advanced.
How should we prepare for an RoC?
Confirm scope, collect current evidence, complete required security testing, identify third-party dependencies and resolve known control weaknesses before the main validation phase.
Continue Your PCI DSS Journey