---
tool_id: WACK-TOOL-0070
concept_id: WACK-CONCEPT-0007
playbook_content_id: WACK-CONTENT-0150
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Payment Access Exit Check

> Make payment-related access leave when a person, volunteer, contractor, or vendor relationship changes.

**Expected output:** An exit record covering payment, provider, website, email, support, device, network, physical, shared, and emergency access with verification evidence.  
**Working time:** 35 minutes  
**Derived from:** WACK-CONTENT-0150

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — List every access path

Inventory named, shared, physical, delegated, support, website, provider, email, and device access.

- [ ] **Which accounts did the person use?**

  Notes: ________________________________________________

- [ ] **Which shared secret or key did they know?**

  Notes: ________________________________________________

## 02 / Map — Assign revocation owners

Connect each access path to a system owner, remover, verifier, date, evidence, and dependent record.

- [ ] **Who performs removal?**

  Notes: ________________________________________________

- [ ] **Who independently verifies it?**

  Notes: ________________________________________________

## 03 / Explain — State the effective access result

Describe removed, rotated, transferred, retained, or unknown access with dates and exceptions.

- [ ] **What remains effective?**

  Notes: ________________________________________________

- [ ] **Which exception has accountable approval?**

  Notes: ________________________________________________

## 04 / Reduce — Eliminate shared and dormant access

Replace unnecessary shared access, remove dormant identities, and narrow vendor or support permissions.

- [ ] **Which credential must rotate?**

  Notes: ________________________________________________

- [ ] **Which account should never have survived?**

  Notes: ________________________________________________

## 05 / Prove — Close and reconcile

Retain removal and verification evidence and update inventories, provider records, contacts, devices, and ownership.

- [ ] **Can current access be reproduced?**

  Notes: ________________________________________________

- [ ] **Which record changed with the departure?**

  Notes: ________________________________________________

## Completion check

- [ ] All payment-related access paths were considered.
- [ ] Removal and verification are separately attributable.
- [ ] Shared credentials and physical access are not omitted.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._