Document Comparison

PCI DSS v4.0 Attestation of Compliance for Report on Compliance - Merchants Entity Name:

Date of Report as noted in the Report on Compliance:

This AOC reflects the results documented in an associated Report on Compliance (ROC). Associated ROC sections are noted in each AOC Part/Section below.

Capitalized terms used but not otherwise defined in this document have the meanings set forth in the PCI DSS Report on Compliance Template.

Part 1. Contact Information Part 1a. Assessed Entity (ROC Section 1.1) Company name:

Company mailing address:

Company mailing address:

Company main website:

Company contact name:

Company contact title:

Contact phone number:

Contact e-mail address:

Part 1b. Assessor (ROC Section 1.1) Provide the following information for all assessors involved in the Assessment. If there was no assessor for a given assessor type, enter Not Applicable.

PCI SSC Internal Security Assessor(s) ISA name(s):

Assessor phone number:

Assessor e-mail address:

Assessor certificate number:

Mail order / telephone order (MOTO) E-Commerce Card-present Are any payment channels not included in this Assessment? If yes, indicate which channel(s) is not included in the Assessment and provide a brief explanation about why the channel was excluded.

Part 2b. Description of Role with Payment Cards (ROC Section 2.1) For each payment channel included in this Assessment as selected in Part 2a above, describe how the business stores, processes, and/or transmits account data.

Channel How Business Stores, Processes, and/or Transmits Account Data Part 2c. Description of Payment Card Environment Provide a high-level description of the environment covered by this Assessment. For example:

• System components that could impact the security of account data.

Facility Type Total Number of Locations (How many locations of this type are in scope) Location(s) of Facility (city, country) Example: Retail locations 3 Boston, MA, USA Part 2e. PCI SSC Validated Products and Solutions (ROC Section 3.3) Does the entity use any item identified on any PCI SSC Lists of Validated Products and Solutions*? Provide the following information regarding each item the entity uses from PCI SSC's Lists of Validated Products and Solutions:

Name of PCI SSC- Validated Product or Version of Product or

PCI SSC Standard to which Product or Solution Was Validated

PCI SSC Listing Expiry Date of YYYY-MM-DD YYYY-MM-DD YYYY-MM-DD YYYY-MM-DD YYYY-MM-DD YYYY-MM-DD * For purposes of this document, ”Lists of Validated Products and Solutions” means the lists of validated products, solutions, and/or components, appearing on the PCI SSC website (www.pcisecuritystandards.org) (for example, 3DS Software Development Kits, Approved PTS Devices, Validated Payment Software, Payment Applications (PA-DSS), Point to Point …

• Store, process, or transmit account data on the entity’s behalf (for example, payment gateways, payment processors, payment service providers (PSPs), and off-site storage)

• Manage system components included in the scope of the Assessment (for example, via network security control services, anti-malware services, security incident and event management (SIEM), contact and call centers, web-hosting services, and IaaS, PaaS, SaaS, and FaaS cloud providers)

• Could impact the security of the entity’s CDE (for example, vendors providing support via remote access, and/or bespoke software developers).

PCI DSS Requirement Requirement Finding More than one response may be selected for a given requirement. Indicate all responses that apply.

Select If Below Method(s) In Place Not Applicable Not Tested Not In Customized Compensating

Section 2 Report on Compliance (ROC Sections 1.2 and 1.3.2) Date Assessment began: Note: This is the first date that evidence was gathered, or observations were made.

YYYY-MM-DD Date Assessment ended: Note: This is the last date that evidence was gathered, or observations were made.

YYYY-MM-DD Were any requirements in the ROC unable to be met due to a legal constraint? Yes No Were any testing activities performed remotely? If yes, for each testing activity below, indicate whether remote assessment activities were performed:

• Examine documentation Yes No

• Interview personnel Yes No

• Examine/observe live data Yes No

• Observe process being performed Yes No

• Observe physical environment Yes No

• Interactive testing Yes No

• All requirements have been assessed and therefore no …

PCI DSS controls will be maintained at all times, as applicable to the entity’s environment.

Part 3b. Merchant Attestation Signature of Merchant Executive Officer  Date: YYYY-MM-DD Merchant Executive Officer Name: Title:

QSA performed testing procedures.

QSA provided other assistance. If selected, describe all role(s) performed:

Signature of Lead QSA  Date: YYYY-MM-DD Lead QSA Name:

ISA(s) performed testing procedures.

ISA(s) provided other assistance.

If selected, describe all role(s) performed: