---
tool_id: WACK-TOOL-0021
concept_id: WACK-CONCEPT-0010
playbook_content_id: WACK-CONTENT-0101
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# PCI-First Platform Capability Review

> Distinguish a PCI requirement catalog from a platform that can preserve the actual assessment model.

**Expected output:** An escaped-work inventory and prioritized PCI domain-capability map with an end-to-end change-propagation test.  
**Working time:** 90 minutes  
**Derived from:** WACK-CONTENT-0101

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Find the work that escapes

Inventory the PCI assessment activities completed outside the platform.

- [ ] **Where are scope relationships, diagrams, provider seams, populations, samples, evidence interpretation, exceptions, assessor work, and report conclusions maintained?**

  Notes: ________________________________________________

- [ ] **Which side record exists because the platform has no adequate object, state, relationship, or role?**

  Notes: ________________________________________________

## 02 / Map — Name the missing product model

Translate escaped work into domain capability rather than a feature wish list.

- [ ] **Which scope, claim, test, population, evidence, sample, responsibility, exception, review, and report objects are missing?**

  Notes: ________________________________________________

- [ ] **Which relationships and change triggers must connect them?**

  Notes: ________________________________________________

## 03 / Explain — Classify actual support

Separate content coverage from operational and assessment capability.

- [ ] **Does the platform provide catalog mapping, workflow, evidence storage, assessment execution, reporting, or some bounded combination?**

  Notes: ________________________________________________

- [ ] **Which marketing statement is larger than the demonstrated product behavior?**

  Notes: ________________________________________________

## 04 / Reduce — Prioritize PCI-native capability

Choose changes that remove duplicate records and restore lineage.

- [ ] **Which missing capability creates the greatest assessment friction or conclusion risk?**

  Notes: ________________________________________________

- [ ] **What is the smallest reusable domain object that closes the gap without hard-coding one engagement?**

  Notes: ________________________________________________

## 05 / Prove — Run the change-propagation test

Use one realistic new fact to test the complete model.

- [ ] **When a security-impacting system, provider limitation, failed sample, or corrected artifact appears, what reopens automatically?**

  Notes: ________________________________________________

- [ ] **Can the platform trace the change through scope, testing, evidence, disposition, review, and report language without a side spreadsheet?**

  Notes: ________________________________________________

## Completion check

- [ ] Escaped PCI work is inventoried without blaming users.
- [ ] Catalog, workflow, assessment, and reporting support are separately classified.
- [ ] One end-to-end change-propagation demonstration has a recorded result.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._