# The Diamond Fulcrum of PCI DSS

Keeping scope, applicability, responsibility, and evidence in formation

**Runtime:** 20 minutes

## 01  The Diamond Fulcrum of PCI DSS

Keeping scope, applicability, responsibility, and evidence in formation

**Speaker notes:** Establish this as an independent practitioner model. The aviation reference is a metaphor grounded in the official four-aircraft Diamond formation. It is not PCI SSC terminology or Navy doctrine.

## 02  Formation drift

The inventory, diagram, provider packet, test population, and evidence repository can each look reasonable while describing different environments.

**Speaker notes:** Use the payment API scenario. Ask the audience which artifact they trust first and why.

## 03  Four claim positions

Scope. Applicability. Implementation and Responsibility. Evidence.

**Speaker notes:** Each position has a different job. The model fails if the positions collapse into one compliance row.

## 04  The fact fulcrum

Assets, services, data flows, identities, locations, providers, responsibilities, configurations, occurrences, and changes form the shared reference.

**Speaker notes:** Facts are not assessment conclusions. They are the attributable material from which the claims are reasoned.

## 05  Scope as reference

Which people, processes, technologies, locations, data, and relationships does the assessment represent?

**Speaker notes:** A stale reference can produce precise answers about the wrong environment.

## 06  Applicability as coupling

Which obligation connects to which subject, predicate, tested fact, authority, response, and reopening trigger?

**Speaker notes:** Applicability must move when its factual predicate moves.

## 07  Implementation and responsibility

Who configures, operates, monitors, reviews, responds, changes, preserves, and proves?

**Speaker notes:** Provider performance moves work. It does not erase retained entity responsibilities or shared handoffs.

## 08  Evidence as support

What supports this claim for the correct subject, population, period, and procedure?

**Speaker notes:** A screenshot is not operating history. A dashboard is not population proof. Preserve contradictions.

## 09  Significant change maneuver

Change the fact. Reopen the claims. Move the consumers. Validate the new formation.

**Speaker notes:** Walk through a new public webhook endpoint and fan its consequences into inventory, testing, SDLC, responsibility, and evidence.

## 10  The assessor validation orbit

The assessor tests the formation. The entity owns the aircraft.

**Speaker notes:** Protect independence. The entity owns its facts and operating representation. The assessor evaluates support and forms professional conclusions.

## 11  Formation check

Choose one changed payment fact. Identify every position and downstream artifact that must move.

**Speaker notes:** Give the room three minutes. The exercise identifies dependencies and uncertainty. It does not decide compliance.

## 12  Keep the claims in formation

Find the changed fact. Map the affected claims. Explain ownership. Reduce unsupported assertions. Prove what remains.

**Speaker notes:** Close with the practitioner position and direct participants to the Formation Alignment Record.

## Authority boundary

The Diamond Fulcrum is Scott Norton's independent practitioner model. It is not PCI SSC terminology or U.S. Navy doctrine and does not imply affiliation with or endorsement by PCI SSC, the U.S. Navy, or the Blue Angels.