# The board question behind the Diamond Fulcrum

Can management demonstrate that its PCI DSS scope, applicability decisions, control responsibilities, and evidence describe the same current payment environment?

## Why this matters

A favorable dashboard or completed assessment package can conceal drift among architecture, responsibility, testing populations, and proof. That drift increases remediation cost, surprises control owners, and weakens the reliability of management assertions.

## What management should show

One attributable fact model; reconciled scope and applicability; named accountable verbs across entity and provider teams; evidence matched to subject, population, period, and procedure; and a change process that reopens every affected claim.

## What the board should ask

Which material payment change last moved the formation? Which claims reopened? Which artifact or testing population failed to move? Who accepted the remaining uncertainty, and when will that decision reopen?

## Authority boundary

The Diamond Fulcrum is Scott Norton's independent practitioner model. It is not PCI SSC terminology or U.S. Navy doctrine and does not imply affiliation with or endorsement by PCI SSC, the U.S. Navy, or the Blue Angels.