W/ OPERATIONS DESK / CLAIMS LAB

Five different objects. One accountable decision.

This lab teaches a practitioner vocabulary with fictional records. It does not determine PCI DSS applicability, perform an assessment, validate a real control, or provide a compliance-accepting-entity decision.

Working matrix Facilitator kit Editable guide / Markdown

FICTIONAL RECORDS / REAL RECONCILIATION DISCIPLINE

Separate the objects before you judge the claim.

Practice separating criteria, facts, records, accountable claims, and bounded conclusions before deciding what one assessment assertion can support.

  1. 01ExpectedCriterion
  2. 02ObservedFact
  3. 03DocumentedRecord
  4. 04AssertedClaim
  5. 05ValidatedConclusion
ACCOUNTABLE ASSERTION

All privileged access to the defined production CDE population was reviewed in each required quarterly occurrence during 2026.

PA-01Policy v4.2

Privileged access is reviewed quarterly for the defined production CDE population.

PA-02Identity export

A September 30 query returned 42 currently privileged accounts.

PA-03Ticket IGA-441

The ticket records a Q4 review and two resolved exceptions.

PA-04Control-owner representation

The owner states that all four quarterly reviews operated during 2026.

PA-05Assessment workpaper

Inspection and reperformance support Q4 only; no conclusion was reached for Q1 through Q3.

0 of 5 records classified.

Search