---
tool_id: WACK-TOOL-0052
concept_id: WACK-CONCEPT-0011
playbook_content_id: WACK-CONTENT-0132
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Hidden Public Presence Discovery and Disposition Register

> Find CDE-relevant public entryways that ordinary website and IP lists miss, then keep discovery facts separate from PCI and testing conclusions.

**Expected output:** A stable register joining names, addresses, paths, protocols, edges, origins, runtimes, applications, code, data, influence, providers, inventories, scans, tests, governance, removal decisions, evidence, and reopening triggers.  
**Working time:** 120 minutes  
**Derived from:** WACK-CONTENT-0132

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Search where endpoints hide

Build candidates from names, edges, code, alternate environments, and provider-managed configuration before filtering for PCI applicability.

- [ ] **Which DNS, certificate, cloud, firewall, edge, provider-console, source-code, configuration, IaC, log, scan, and incident sources were reconciled?**

  Notes: ________________________________________________

- [ ] **Which webhook, callback, origin, API stage, function URL, IPv6 listener, DR site, legacy name, alternate port, or temporary route appears in only one source?**

  Notes: ________________________________________________

## 02 / Map — Separate the public-presence objects

Do not compress one journey into a hostname row; map every addressable and operable layer.

- [ ] **What URL, FQDN, address, protocol, port, CDN or WAF, load balancer, origin, runtime, application, repository, data, secret, owner, provider, and environment are involved?**

  Notes: ________________________________________________

- [ ] **Which stable identifiers join those objects to inventory, diagrams, payment flows, scans, penetration tests, changes, and monitoring?**

  Notes: ________________________________________________

## 03 / Explain — Disposition each obligation independently

Record public reachability as an observation, then decide PCI relationship and each testing or governance treatment separately.

- [ ] **Is the point CDE, connected, security-impacting, unrelated, or unresolved—and what evidence supports that relationship?**

  Notes: ________________________________________________

- [ ] **What ASV, other external scan, penetration test, application inventory, SDLC, change, monitoring, and provider-coverage treatment applies or remains open?**

  Notes: ________________________________________________

## 04 / Reduce — Remove public presence that has no future

Prefer elimination or restriction over increasingly elaborate explanations for abandoned exposure.

- [ ] **Which legacy name, direct origin, alternate protocol, test system, emergency route, or duplicate entryway can be disabled now?**

  Notes: ________________________________________________

- [ ] **How will removal be verified across DNS, certificates, cloud configuration, network reachability, code, provider settings, and monitoring?**

  Notes: ________________________________________________

## 05 / Prove — Reconcile every population

Demonstrate that discovered candidates and final dispositions propagate to every dependent operating record.

- [ ] **Do inventory, diagrams, ASV and external scan submissions, penetration-test scope, application records, and provider evidence explain every retained point?**

  Notes: ________________________________________________

- [ ] **Which certificate, DNS, listener, deployment, provider, recovery, or firewall change automatically reopens the register and dependent decisions?**

  Notes: ________________________________________________

## Completion check

- [ ] Every candidate records how it was discovered and whether its reachability was confirmed.
- [ ] URL, hostname, address, edge, origin, runtime, application, code, data, and ownership remain separate but joined objects.
- [ ] PCI relationship, ASV and other scan treatment, penetration testing, application governance, provider coverage, and continued need have independent dispositions.
- [ ] Authenticated, obscure, nonproduction, alternate, recovery, IPv6, and provider-configured entryways are not excluded merely by label.
- [ ] Every exclusion or separate-coverage decision identifies evidence, authority, date, and reopening trigger.
- [ ] Removed public presence has technical verification and retained decision history.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._