---
tool_id: WACK-TOOL-0068
concept_id: WACK-CONCEPT-0019
playbook_content_id: WACK-CONTENT-0148
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Small-Merchant External Scan Question Record

> Turn an unexpected scan question into a dated applicability, population, ownership, and evidence discussion.

**Expected output:** A record of public-facing assets, payment relationship, current validation direction, scan applicability question, provider or ASV contact, result history, and next action.  
**Working time:** 45 minutes  
**Derived from:** WACK-CONTENT-0148

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Inventory the public edge

List websites, addresses, portals, APIs, webhooks, remote support, and other Internet-reachable assets related to payment.

- [ ] **What is externally reachable?**

  Notes: ________________________________________________

- [ ] **How does it relate to payment or CDE security?**

  Notes: ________________________________________________

## 02 / Map — Join asset to direction

Connect each asset to owner, provider, DNS or edge service, payment journey, questionnaire, and current program direction.

- [ ] **Who supplied the scan direction?**

  Notes: ________________________________________________

- [ ] **What target population is represented?**

  Notes: ________________________________________________

## 03 / Explain — State the unresolved question

Separate observed reachability from the fact-specific scanning and validation conclusion.

- [ ] **What is known today?**

  Notes: ________________________________________________

- [ ] **Which authority must decide the open question?**

  Notes: ________________________________________________

## 04 / Reduce — Close accidental exposure

Remove unused public services and correct missing ownership, addresses, provider assumptions, and target gaps.

- [ ] **Which exposure is unnecessary?**

  Notes: ________________________________________________

- [ ] **Which address or hostname is missing?**

  Notes: ________________________________________________

## 05 / Prove — Preserve the scan chain

Retain current direction, target list, ASV or scanner records, results, remediation, rescans, and changes.

- [ ] **Does the evidence cover the right period?**

  Notes: ________________________________________________

- [ ] **What event changes the population?**

  Notes: ________________________________________________

## Completion check

- [ ] The public asset population is complete and owned.
- [ ] Applicability is not inferred from a portal label alone.
- [ ] Results, corrections, and required follow-up remain historically visible.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._