---
tool_id: WACK-TOOL-0089
concept_id: WACK-CONCEPT-0012
playbook_content_id: WACK-CONTENT-0169
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# PCI Evidence Reuse Admission Record

> Decide which facts from another framework or engagement can support one bounded PCI DSS claim without importing its conclusion, scope assumptions, or authority.

**Expected output:** A seven-state admission record that preserves the donor object, receiving PCI claim, scope, population, period, procedure, results, limitations, residual work, owners, and authority boundary.  
**Working time:** 50 minutes  
**Derived from:** WACK-CONTENT-0169

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Preserve the donor object

Select one SOC, ISO, NIST, internal-audit, cloud-assurance, certification, or GRC object already offered for a PCI DSS request. Record its exact source, version, objective, scope, population, period, procedure, result, exceptions, limitations, transformations, and original authority.

- [ ] **What is the object—not merely its framework label?**

  Notes: ________________________________________________

- [ ] **Which conclusion belongs only to the donor engagement?**

  Notes: ________________________________________________

## 02 / Map — Run the admission gates

State the receiving PCI claim, then compare subject and payment scope, requirement and procedure, population and variants, time and occurrence, provenance and method, results and limitations, and authority. Mark each gate exact, partial, unknown, or mismatched.

- [ ] **Which gate prevents full admission?**

  Notes: ________________________________________________

- [ ] **Which part remains independently useful?**

  Notes: ________________________________________________

## 03 / Explain — Bound what travels

Separate reusable implementation facts, reusable underlying evidence, required residual PCI testing, donor conclusions, entity assertions, assessor judgment, and compliance-program acceptance. Preserve explicit non-claims.

- [ ] **What may travel with the artifact?**

  Notes: ________________________________________________

- [ ] **What must be decided again under the PCI claim?**

  Notes: ________________________________________________

## 04 / Reduce — Choose the smallest honest disposition

Record admitted, admitted with residual testing, partial, context only, superseded, contradictory, or rejected. Reference the authoritative object and assign the smallest missing collection or test, owner, due state, and retest condition.

- [ ] **Can the artifact avoid a duplicate request?**

  Notes: ________________________________________________

- [ ] **What is the smallest repair that closes the receiving gap?**

  Notes: ________________________________________________

## 05 / Prove — Remove the framework argument

Give the record and original object to a cold reviewer. Require them to reconstruct the receiving claim, admitted facts, failed gates, residual work, limitations, and authority boundary without oral rescue or automatic status inheritance.

- [ ] **Can the decision be reproduced?**

  Notes: ________________________________________________

- [ ] **Would a changed source, scope, population, period, or procedure reopen it?**

  Notes: ________________________________________________

## Completion check

- [ ] The receiving PCI DSS claim, requirement or testing objective, subject, environment, population, period, and pending conclusion are explicit.
- [ ] The donor object retains its source, purpose, original scope, procedure, result, exceptions, limitations, and authority.
- [ ] Payment scope, direct requirement relationship, timeframe, testing specifics, population variants, results, and limitations are evaluated independently.
- [ ] Another framework's certification, attestation, status, or conclusion is not imported as a PCI DSS assessment result.
- [ ] Admitted facts and residual PCI testing are distinct and attributable.
- [ ] The disposition is one of admitted, admitted with residual testing, partial, context only, superseded, contradictory, or rejected.
- [ ] Every partial or rejected decision names the failed gate, retained value, smallest repair, owner, and retest condition.
- [ ] Entity assertion, assessor judgment, and compliance-program acceptance remain separate authorities.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._