---
tool_id: WACK-TOOL-0047
concept_id: WACK-CONCEPT-0001
playbook_content_id: WACK-CONTENT-0127
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# PCI DSS Plane Intersection Matrix

> Turn one flat requirement-to-document link into a time-aware chain across architecture, account data, control, governance, evidence, assessment, and risk.

**Expected output:** A seven-plane matrix joining one bounded requirement claim to subjects, data states, control mechanisms, accountable roles, attributable evidence, independent tests, risk rationale, time validity, intersections, contradictions, and reopening triggers.  
**Working time:** 150 minutes  
**Derived from:** WACK-CONTENT-0127

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Choose one consequential coordinate

Select one requirement claim and collect every named architecture subject, data state, control, person, provider, evidence artifact, assessment test, risk decision, and time interval connected to it.

- [ ] **What exact subject, population, implementation, and period does the claim cover?**

  Notes: ________________________________________________

- [ ] **Which facts are merely adjacent rather than demonstrably connected?**

  Notes: ________________________________________________

## 02 / Map — Project the seven planes

Place each fact on its proper plane, assign durable identifiers, and record valid-from, valid-to, source, owner, and relationship for every crossing.

- [ ] **Which identifier survives every projection?**

  Notes: ________________________________________________

- [ ] **Where does the graph fork, stop, or contradict itself?**

  Notes: ________________________________________________

## 03 / Explain — Name authority and statement role

Separate normative source language, entity assertion, provider fact, organizational position, practitioner method, assessor judgment, evidence observation, and accepting-entity direction.

- [ ] **Who can responsibly make this statement?**

  Notes: ________________________________________________

- [ ] **Is a tool result being asked to carry an assessor conclusion?**

  Notes: ________________________________________________

## 04 / Reduce — Remove plane-crossing shortcuts

Eliminate orphan evidence, duplicate names, requirement-to-file shortcuts, stale snapshots, provider hand-waves, and risk language used as an unrecorded scope conclusion.

- [ ] **Which translation can become a stable relationship instead of annual prose?**

  Notes: ________________________________________________

- [ ] **Which record exists only to compensate for a missing intersection?**

  Notes: ________________________________________________

## 05 / Prove — Traverse twice through time

Walk the same requirement coordinate through all seven planes at two meaningful dates, reconcile changes and contradictions, and state the exact bounded conclusion supported.

- [ ] **What changed between the two views?**

  Notes: ________________________________________________

- [ ] **Which affected facts and claims reopened when it changed?**

  Notes: ________________________________________________

## Completion check

- [ ] The requirement claim preserves one explicit subject, population, implementation, period, and authority boundary.
- [ ] Architecture, data, control, governance, evidence, assessment, and risk facts use durable, cross-referenceable identifiers.
- [ ] Evidence observations remain distinct from the assessor's independent testing and conclusion.
- [ ] Every material fact carries time validity and a change or reopening path.
- [ ] The complete chain can be traversed at two dates without silently substituting current state for historical operation.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._