---
tool_id: WACK-TOOL-0027
concept_id: WACK-CONCEPT-0010
playbook_content_id: WACK-CONTENT-0107
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Claims Ledger Starter

> Turn assessment assertions into bounded, attributable, testable, and reopenable records.

**Expected output:** A claim register joining subject, boundary, claim period, assessment cut-off, evidence period, evidence-time lane, authority, test, population, evidence, exceptions, owners, review, disposition, report use, and reopening triggers.  
**Working time:** 120 minutes  
**Derived from:** WACK-CONTENT-0107

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Write the proposition

Create one row for one material, falsifiable assessment assertion.

- [ ] **What exact statement is being made about which subject, boundary, population, and claim period?**

  Notes: ________________________________________________

- [ ] **What is the assessment cut-off, and does the row need to be split because implementations, owners, timeframes, or expected conditions differ?**

  Notes: ________________________________________________

## 02 / Map — Connect the proof chain

Bind the claim to its source, test, evidence period, people, and reporting destination.

- [ ] **Which PCI DSS requirement and testing procedure govern this assertion?**

  Notes: ________________________________________________

- [ ] **What evidence period does each artifact actually represent, which evidence-time lane does it occupy, and where are gaps, exceptions, or contradictory facts recorded?**

  Notes: ________________________________________________

## 03 / Explain — Preserve authority

Keep representation, judgment, interpretation, and acceptance separate.

- [ ] **Who owns the fact, performs the control, represents the condition, tests it, and records the conclusion?**

  Notes: ________________________________________________

- [ ] **Which statement is PCI SSC source language and which is practitioner or assessor judgment?**

  Notes: ________________________________________________

## 04 / Reduce — Remove hidden assumptions

Split or qualify claims before the conclusion becomes larger than the evidence.

- [ ] **Which duplicate claim, unsupported boundary, population gap, or stale artifact can be resolved now?**

  Notes: ________________________________________________

- [ ] **Which pending or contradictory state must remain visible instead of being forced to green?**

  Notes: ________________________________________________

## 05 / Prove — Trace and reopen

Test the ledger in both directions.

- [ ] **Can a reviewer move from final report language back to facts, tests, evidence, exceptions, and owners?**

  Notes: ________________________________________________

- [ ] **When one scope, provider, evidence, occurrence, or test fact changes, do the affected claims visibly reopen?**

  Notes: ________________________________________________

## Completion check

- [ ] Every row states one bounded and testable proposition.
- [ ] The claim period, assessment cut-off, and evidence period are explicit and remain distinct.
- [ ] Evidence-time lane and coverage are stated rather than inferred from a file date.
- [ ] Entity representation and assessor disposition are separate fields.
- [ ] Every concluded claim has a reviewer, date, rationale, and reopening trigger.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._