# The Blue Angels Diamond Fulcrum of PCI DSS

**Canonical content:** WACK-CONTENT-0165  
**Status:** Draft pending named practitioner review  
**Authority:** PCI SSC source material + assessor judgment + practitioner position + practitioner method  

> PCI DSS is not a catalog of obligations flying independently. It is a formation whose claims must remain aligned with authoritative facts about the environment.

## Authority boundary

The Blue Angels Diamond Fulcrum is an independent Cluster of Wack practitioner model inspired by the official Blue Angels Diamond formation. It is not PCI SSC terminology, U.S. Navy doctrine, an assessment result, or a claim of affiliation or endorsement by PCI SSC, the U.S. Navy, or the Blue Angels.

## The formation

| Position | Job | Stopping question |
| --- | --- | --- |
| Scope | Establish the people, processes, technologies, locations, data, and relationships being represented. | Does this describe the current environment? |
| Applicability | Join requirements and reporting direction to scoped subjects, predicates, facts, and authority. | Which fact makes this apply—or not apply? |
| Implementation + Responsibility | State how the control operates and who performs each accountable verb. | Who configures, operates, monitors, changes, responds, and proves? |
| Evidence | Support a bounded claim for the right subject, population, period, and procedure. | Where does the support end? |

## The Fact Fulcrum

Record the shared facts before writing the assessment conclusion:

`Asset → Service → Environment → Protocol → Connection → Data flow → Identity → Location → TPSP → Responsibility → Configuration → Occurrence → Change`

Facts are not compliance conclusions. They are versioned, attributable material from which the assessed entity represents its environment and against which the assessor performs testing.

## Formation integrity laws

1. If **Scope moves**, reconsider Applicability.
2. If **Applicability moves**, reconcile Implementation and Responsibility.
3. If **Implementation changes**, refresh the evidence contract and testing populations.
4. If **Evidence contradicts the assertion**, stop the conclusion where support ends.
5. A significant change is a formation maneuver: move every dependent inventory, diagram, provider record, identity, testing population, policy, obligation, evidence expectation, and report response.

## Assessor boundary

The assessor is not one of the entity's aircraft.

The assessed entity owns its environment, representations, implementations, responsibilities, evidence, and provider relationships. The assessor examines, observes, interviews, tests, and corroborates whether the formation presented is accurately defined, documented, and supported.

## 75-minute alignment exercise

### 1. Find — 15 minutes

Choose one consequential payment capability. Record its authoritative facts, sources, owners, effective dates, and unknowns.

### 2. Map — 15 minutes

Write four separate claims: Scope, Applicability, Implementation and Responsibility, and Evidence. Join each claim to exact facts.

### 3. Explain — 15 minutes

Name entity representation, decision authority, assessor procedure, evidence population and period, bounded result, limitation, and non-claim.

### 4. Reduce — 10 minutes

Remove copied conclusions, duplicate fact stores, ownerless provider deferrals, stale evidence, and document-only updates. Preserve unresolved contradictions.

### 5. Prove — 20 minutes

Inject one significant change. Trace every affected fact, claim, inventory, diagram, provider record, scan target, penetration-test proposition, obligation, evidence contract, and report response. Record test, disposition, and reopening trigger.

## The field law

> You do not assess hundreds of obligations in isolation. You assess whether every applicable obligation remains in formation with the facts of the environment.

## Primary grounding

- PCI DSS v4.0.1 — PCI Security Standards Council.
- PCI SSC FAQ 1473 — assessor and compliance-accepting-entity roles in applicability and reporting.
- PCI SSC FAQ 1566 — QSA responsibility for evaluating evidence relevance, scope, timeframe, testing conditions, and support for an opinion.
- Blue Angels History: Significant Events — official history of the Diamond Formation.
- 2026 Blue Angels Maneuvers Manual — official formation and maneuver reference.

Use the companion **Diamond Fulcrum Formation Alignment Record** to document the exercise. This material is educational and does not replace PCI DSS, assessor evaluation, or compliance-program direction.