---
tool_id: WACK-TOOL-0002
concept_id: WACK-CONCEPT-0009
playbook_content_id: WACK-CONTENT-0021
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Defensible Scope Story Builder

> Connect every material inclusion, exclusion, and segmentation conclusion to current architecture facts.

**Expected output:** A reviewable scope narrative with evidence, owners, boundaries, and change triggers.  
**Working time:** 75 minutes  
**Derived from:** WACK-CONTENT-0021

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Collect every scope claim

Gather records that state or imply what is included and excluded.

- [ ] **Which inventories, diagrams, data flows, narratives, rules, service lists, and testing populations make scope claims?**

  Notes: ________________________________________________

- [ ] **Where do the records disagree about a system, connection, owner, or boundary?**

  Notes: ________________________________________________

## 02 / Map — Trace influence as well as data

Map data, connectivity, administration, and security dependencies.

- [ ] **Where does account data enter, move, rest, transform, and leave?**

  Notes: ________________________________________________

- [ ] **Which identity, deployment, monitoring, management, or provider services can affect the environment?**

  Notes: ________________________________________________

## 03 / Explain — Write the rationale

State inclusion and exclusion using facts rather than labels.

- [ ] **What current fact supports each material boundary decision?**

  Notes: ________________________________________________

- [ ] **What control and testing support each segmentation conclusion?**

  Notes: ________________________________________________

## 04 / Reduce — Narrow the real boundary

Find avoidable relationships that enlarge or destabilize the scope story.

- [ ] **Which shared service, administrative path, or unused connection can be removed or isolated?**

  Notes: ________________________________________________

- [ ] **What dependency prevents a simpler, more durable boundary?**

  Notes: ________________________________________________

## 05 / Prove — Bind conclusion to evidence

Make the story reconstructable by a new reviewer.

- [ ] **Which evidence, owner, and verification date support each conclusion?**

  Notes: ________________________________________________

- [ ] **Which architecture or service change triggers renewed scoping analysis?**

  Notes: ________________________________________________

## Completion check

- [ ] Inventory, diagrams, narratives, and testing populations describe the same boundary.
- [ ] Every exclusion has a fact-based rationale.
- [ ] Every material change trigger has an owner.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._