FAQ #1382 Diff

Yes. Where an entity wishes to perform a partialwants its assessor to conduct a PCI DSS assessment against only a subset of PCI DSS requirements, it is acceptable to document such anthis partial assessment using the Report on Compliance (ROC). Such resulting reports are commonly referred to as a "Partial ROC" and often indicate the entity being assessed has yet to reach full compliance against PCI DSS. The Attestation of Compliance (AOC) mayis also be completed after the finalized partial ROC to demonstrate compliant findingsa PCI DSS assessment to summarize and attest to the results of the assessment.
There are a number of reasons why an entity may wish to performwant to undergo a partial assessment, such as:
- An entitymay only needincluding:

An entity only needs to validate a subset of requirements to their acquirer (e.g.for example, using the prioritized approach to validate only certain milestones);
-
An entity may wishwants to validate a new security control that impacts only a subset of requirements (e.g.for example, a new encryption methodology requiring assessment to PCI DSS Requirements 3 and 4);
- An entity may offer a service that addresses only a limited number of PCI DSS requirements (e.g., aA service provider identifies which PCI DSS requirements are included in the scope of their service offering and only wants those covered in the assessment (for example, a data center hosting provider only wisheswants to validate physical security controls per PCI DSS Requirement 9 for their hosting facility);
- An entity with an environment that fully meets all the eligibility criteria defined in a particular SAQ may use that SAQ as a reference to identify the applicable PCI DSS requirements for that environment.
-
During a Token Service Provider (TSP) engagement, the TSP assessor may determinedetermines that a partial ROC needs to be completed toPCI DSS assessment will adequately address the additional considerations for PCI DSS Requirements 1-12 that affect TSPs.

When documenting such an assessment, the assessor willis expected to clearly communicate that testing of all requirements has not been performed by documenting which specific requirements were tested and which were not tested within both the ROC and the AOC.
It is imperative that the assessor clearly define the scope of the assessment in the Summary Overview of the ROC and in relevant sections of the AOC. Once the scope of the assessment has been documented, the assessor must ensure that the remainder of the ROC and AOC are consistent with the Summary Overview. At no point, should the AOC for the completion of a partial assessment indicate an organization's full compliance with PCI DSS.

The PCI DSS ROC Reporting Instructions provide detailed instruction onThe PCI DSS ROC Template provides detailed instructions on how to properly define the scope of the assessment, and how to properly document the findings from the testing performed, including the difference between "Not Tested" and "Not Applicable" findingresponses. Accurate documentation of assessment activities performed and related findings allows any individual who readsprovides readers of the report to have a clear understanding of the report and removeremoves any ambiguity ofabout the scope of the assessment review.
Note that whether a "Not Tested" response can result in PCI DSS compliance is treated differently between PCI DSS v3.2.1 and v4.0 - QSAs must refer to the ROC Template and ROC Template FAQs for the version of the standard being used for relevant guidance.

See also:
FAQ 1473: What is the role of compliance-accepting entities and assessors in determining the applicability of PCI DSS requirements for merchant and service provider PCI DSS assessments?
FAQ 1331: Can SAQ eligibility criteria be used as a guide for determining applicability of PCI DSS requirements for merchant assessments in a Report on Compliance?