---
tool_id: WACK-TOOL-0071
concept_id: WACK-CONCEPT-0008
playbook_content_id: WACK-CONTENT-0151
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Seven-Question Provider Assurance Card

> Ask enough to understand a provider's service and responsibility seam without turning a badge into a conclusion.

**Expected output:** A seven-question record covering exact service, evidence, coverage, dates, customer duties, changes, and incident contacts.  
**Working time:** 35 minutes  
**Derived from:** WACK-CONTENT-0151

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Collect the assurance packet

Collect the exact service description, current official evidence, dates, scope, limitations, and contacts.

- [ ] **What exact service is covered?**

  Notes: ________________________________________________

- [ ] **Is the evidence current?**

  Notes: ________________________________________________

## 02 / Map — Join service to business use

Connect the covered service to the member account, feature, integration, payment journey, configuration, and owner.

- [ ] **Do we consume the covered service?**

  Notes: ________________________________________________

- [ ] **Which feature or region differs?**

  Notes: ________________________________________________

## 03 / Explain — Answer the seven questions

Record service, evidence, coverage, dates, customer duties, change notification, and incident contact answers.

- [ ] **Which answer is incomplete?**

  Notes: ________________________________________________

- [ ] **Which answer is marketing rather than assurance evidence?**

  Notes: ________________________________________________

## 04 / Reduce — Resolve assurance gaps

Escalate incorrect, stale, contradictory, or incomplete documentation and remove unsupported assumptions.

- [ ] **What needs correction?**

  Notes: ________________________________________________

- [ ] **What safer design or service choice exists?**

  Notes: ________________________________________________

## 05 / Prove — Monitor the relationship

Retain assurance documents, customer duties, changes, incidents, correspondence, and review dates.

- [ ] **Who notices a new AOC?**

  Notes: ________________________________________________

- [ ] **What change reopens review?**

  Notes: ________________________________________________

## Completion check

- [ ] Evidence matches the exact consumed service.
- [ ] Customer and shared responsibilities have owners.
- [ ] Contradictions remain visible until resolved.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._