---
tool_id: WACK-TOOL-0035
concept_id: WACK-CONCEPT-0012
playbook_content_id: WACK-CONTENT-0115
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Missed ASV Occurrence Decision Record

> Recover a missed ASV quarter without backdating it, then separate current correction, assessor judgment, and compliance-program direction.

**Expected output:** A four-lane record covering the historical occurrence, current scan-remediate-rescan state, corrective operating process, assessor conclusion, and compliance-accepting-entity question and response.  
**Working time:** 120 minutes  
**Derived from:** WACK-CONTENT-0115

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Preserve the missed occurrence

Record the expected window and unedited evidence before creating the remediation narrative.

- [ ] **Was the failure no scan, incomplete coverage, or an unfinished passing cycle?**

  Notes: ________________________________________________

- [ ] **Which scan, ticket, contract, notification, population, owner, and discovery records establish the chronology?**

  Notes: ________________________________________________

## 02 / Map — Separate the four decision lanes

Do not make one party's role answer every question.

- [ ] **What belongs to historical fact, current technical correction, assessor testing and conclusion, and accepting-entity program direction?**

  Notes: ________________________________________________

- [ ] **Which evidence, owner, date, open question, and output belong to each lane?**

  Notes: ________________________________________________

## 03 / Explain — Test the published conditions

Describe cause, correction, exceptional-circumstance claim, and prevention without rewriting time.

- [ ] **What evidence supports a repeatable documented process and successful current performance?**

  Notes: ________________________________________________

- [ ] **What makes the cause exceptional rather than poor scheduling, recurring failure, or weak practice?**

  Notes: ________________________________________________

## 04 / Reduce — Engineer out the silent miss

Replace reminders with an observable scan operating system.

- [ ] **Who owns scheduling, population approval, remediation, rescans, contract state, backup, and escalation?**

  Notes: ________________________________________________

- [ ] **Which alert detects a missing run, incomplete population, unclosed finding, or expiring window?**

  Notes: ________________________________________________

## 05 / Prove — Close each lane honestly

Complete the current process and retain the assessment and program decisions separately.

- [ ] **Does the current scan-remediate-rescan evidence cover the complete applicable population?**

  Notes: ________________________________________________

- [ ] **What did the assessor conclude, what did the accepting entity direct, and where are both decisions recorded?**

  Notes: ________________________________________________

## Completion check

- [ ] The missed period remains visible and is never backdated.
- [ ] All current scans, findings, remediation, and rescans are preserved.
- [ ] Cause and recurrence prevention have evidence and accountable owners.
- [ ] Assessor judgment and compliance-accepting-entity direction occupy separate fields.
- [ ] The next scan window has an independently monitored completion path.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._