---
tool_id: WACK-TOOL-0034
concept_id: WACK-CONCEPT-0010
playbook_content_id: WACK-CONTENT-0114
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# PCI-Native Product Acceptance Test

> Determine whether a GRC platform supports the relationships that make PCI assessment work testable or merely stores PCI-shaped content.

**Expected output:** A product capability record covering scope graphs, claim-to-test chains, occurrence history, evidence populations, TPSP seams, authority, change impact, and report lineage under four adversarial scenarios.  
**Working time:** 150 minutes  
**Derived from:** WACK-CONTENT-0114

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Inventory escaped PCI work

Start with the spreadsheets, diagrams, tickets, portals, and workpapers that complete the platform's model.

- [ ] **Which scope, population, sampling, testing, responsibility, exception, retest, and reporting activities happen outside the product?**

  Notes: ________________________________________________

- [ ] **Which missing object or relationship forces each escape?**

  Notes: ________________________________________________

## 02 / Map — Draw the PCI product graph

Connect the payment journey to every object required for an assessment claim.

- [ ] **Can the product traverse payment journey, boundary, component, service, responsibility, requirement, test, claim, occurrence, population, sample, evidence, result, and report?**

  Notes: ________________________________________________

- [ ] **Which relationships are native, configured, exported, or absent?**

  Notes: ________________________________________________

## 03 / Explain — Publish the capability boundary

Separate catalog, workflow, storage, assessment, judgment, and reporting support.

- [ ] **What does the product actually do at each layer?**

  Notes: ________________________________________________

- [ ] **Which professional or compliance-program decisions must remain human and attributable?**

  Notes: ________________________________________________

## 04 / Reduce — Prioritize lineage repairs

Fix the missing relationships that create duplicate systems of record.

- [ ] **Which stable identifiers, occurrence records, evidence metadata, responsibility seams, and reopening triggers remove the most side work?**

  Notes: ________________________________________________

- [ ] **Which cosmetic features can wait until the graph is coherent?**

  Notes: ________________________________________________

## 05 / Prove — Run four adversarial events

Test the product when the PCI story changes or fails.

- [ ] **What reopens when a security-impacting component is added or a periodic occurrence is missed?**

  Notes: ________________________________________________

- [ ] **What changes when a TPSP limitation appears or an assessor sample fails?**

  Notes: ________________________________________________

## Completion check

- [ ] Every escaped activity maps to a missing or external capability.
- [ ] Scope and evidence are relationship records rather than tags and attachments alone.
- [ ] Occurrences preserve missed, failed, partial, and corrected history.
- [ ] Authority and accepting-entity direction remain distinct from automated status.
- [ ] All four adversarial events produce traceable downstream impact.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._