---
tool_id: WACK-TOOL-0062
concept_id: WACK-CONCEPT-0019
playbook_content_id: WACK-CONTENT-0142
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Assessment Cut-Off and Remediation Reconciliation Record

> Keep a future remediation promise from becoming a present-tense assessment conclusion before implementation and testing are complete.

**Expected output:** A dated requirement-instance record separating proposed, implemented, demonstrated, and assessed states, with production evidence, historical limitations, cut-off treatment, ownership, authority, and reopening triggers.  
**Working time:** 75 minutes  
**Derived from:** WACK-CONTENT-0142

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Fix the time boundary

Collect the requirement instance, assessment period, evidence period, report cut-off, current response, remediation items, implementation facts, operating evidence, failures, retests, and reporting history.

- [ ] **What did the evidence support at the cut-off?**

  Notes: ________________________________________________

- [ ] **Which artifact proves only intent rather than completed operation?**

  Notes: ________________________________________________

## 02 / Map — Separate the four states

Join proposed, implemented, demonstrated, and assessed states to exact dates, subjects, environments, populations, evidence, procedures, owners, authorities, limitations, and transitions.

- [ ] **Which state is currently implied rather than evidenced?**

  Notes: ________________________________________________

- [ ] **What historical fact would a current green status conceal?**

  Notes: ________________________________________________

## 03 / Explain — Write the chronology

State what was absent, planned, completed, effective, observed, tested, limited, and concluded without allowing later work to rewrite the earlier record.

- [ ] **When did the control become effective in production?**

  Notes: ________________________________________________

- [ ] **What does the assessment response claim—and what does it not claim?**

  Notes: ________________________________________________

## 04 / Reduce — Remove future-tense proof

Remove roadmaps, target dates, approvals, and unfinished tickets from present-tense proof; retain them as governed remediation records with explicit acceptance criteria.

- [ ] **What evidence must exist before this state can advance?**

  Notes: ________________________________________________

- [ ] **Which ambiguous status should be split into separate records?**

  Notes: ________________________________________________

## 05 / Prove — Reconcile the cut-off

Compare open and recently closed remediation with affected workpapers, reperform applicable tests, preserve remaining limitations, and show that post-cut-off work cannot silently alter the report.

- [ ] **What completed before report closure and what remained future state?**

  Notes: ________________________________________________

- [ ] **Can a cold reviewer reproduce every state transition from evidence?**

  Notes: ________________________________________________

## Completion check

- [ ] The requirement instance, assessment period, evidence period, report cut-off, subject, environment, and population are explicit.
- [ ] Proposed, implemented, demonstrated, and assessed remain separate states with dated transition evidence.
- [ ] Plans, approvals, target dates, and open tickets are retained as remediation governance rather than implementation proof.
- [ ] Production implementation and operating evidence are distinguished from design and non-production preparation.
- [ ] Point-in-time configuration and performance across a defined period are evaluated separately where applicable.
- [ ] Missed and failed occurrences remain visible after current correction and successful retest.
- [ ] Any use of initial-assessment or missed-periodic-activity guidance is requirement-specific, source-bound, and explicitly reasoned.
- [ ] The assessment response, assessor judgment, entity representation, remediation ownership, and accepting-entity direction remain distinct.
- [ ] The cut-off reconciliation identifies completed work, tested evidence, changed conclusions, unresolved limitations, and future-state items.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._