---
tool_id: WACK-TOOL-0044
concept_id: WACK-CONCEPT-0015
playbook_content_id: WACK-CONTENT-0124
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# ISV PCI Claim and Responsibility Record

> Translate an ISV's PCI adjective into exact, testable product, service, deployment, evidence, responsibility, and lifecycle propositions.

**Expected output:** A vendor claim record joining claimant, legal entity, PCI standard or program, assessed object, product or service, version, deployment, period, functions, evidence, responsibilities, production reconciliation, lifecycle obligations, and reopening triggers.  
**Working time:** 150 minutes  
**Derived from:** WACK-CONTENT-0124

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Collect every claim and object

Inventory statements, listings, AOCs, products, services, versions, deployment models, integrations, guides, contracts, and production variants.

- [ ] **What exact noun does PCI compliant modify?**

  Notes: ________________________________________________

- [ ] **Which artifact supports that noun for this period and implementation?**

  Notes: ________________________________________________

## 02 / Map — Separate roles and assurance layers

Map software development, hosted service, TPSP activity, integration, processor dependency, customer operation, and accepting-entity direction independently.

- [ ] **Which PCI program or standard applies to each object?**

  Notes: ________________________________________________

- [ ] **Which activity assigns responsibility to which party?**

  Notes: ________________________________________________

## 03 / Explain — Reconcile the claim to production

Match legal entity, service, version, region, functions, dependencies, exclusions, deployment, and customer duties to current reality.

- [ ] **Which mismatch remains unresolved?**

  Notes: ________________________________________________

- [ ] **Which scope or validation conclusion depends on the match?**

  Notes: ________________________________________________

## 04 / Reduce — Remove ambiguous seams

Minimize customization, data paths, privileges, plugins, support access, unsupported versions, retained data, and shared duties without named ownership.

- [ ] **Which variant exists only because nobody challenged it?**

  Notes: ________________________________________________

- [ ] **Which duty can be assigned, automated, or eliminated?**

  Notes: ________________________________________________

## 05 / Prove — Test one production journey and lifecycle

Exercise integration seams, evidence lineage, version status, change notification, vulnerability response, incident coordination, and reopening behavior.

- [ ] **Can the ISV and customer tell the same payment story?**

  Notes: ________________________________________________

- [ ] **What happens to the claim when software, service, dependency, or evidence changes?**

  Notes: ________________________________________________

## Completion check

- [ ] Every compliance claim names an exact claimant, object, standard or program, period, and evidence artifact.
- [ ] Product assurance, provider assessment, customer deployment, and merchant validation remain distinct.
- [ ] Production versions, services, regions, dependencies, and configurations reconcile to evidence.
- [ ] Provider, customer, processor, and other-party responsibilities are explicitly allocated.
- [ ] Lifecycle changes, expiry, incidents, and mismatches reopen affected claims.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._