---
tool_id: WACK-TOOL-0073
concept_id: WACK-CONCEPT-0015
playbook_content_id: WACK-CONTENT-0153
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# Suspected Payment Incident First-Hour Card

> Give a small organization a calm, approved contact-and-preservation path before a suspected payment event becomes improvised response.

**Expected output:** A first-hour reference naming internal authority, acquirer, providers, response, legal and insurance contacts, approved preservation actions, communications constraints, and decision log.  
**Working time:** 40 minutes  
**Derived from:** WACK-CONTENT-0153

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Prepare contacts and facts

Name the approved decision owner, acquirer, providers, response team, legal counsel, insurer, and evidence-preservation guidance.

- [ ] **Who has authority to activate the plan?**

  Notes: ________________________________________________

- [ ] **Which contact must be available after hours?**

  Notes: ________________________________________________

## 02 / Map — Connect the response path

Join likely observations to notification, containment, preservation, communication, and escalation owners.

- [ ] **Who receives the first report?**

  Notes: ________________________________________________

- [ ] **Which provider or authority has notification expectations?**

  Notes: ________________________________________________

## 03 / Explain — Record observations, not guesses

Capture who observed what, when, where, on which system, and which approved actions followed.

- [ ] **What is directly known?**

  Notes: ________________________________________________

- [ ] **What must not be claimed yet?**

  Notes: ________________________________________________

## 04 / Reduce — Prevent destructive improvisation

Remove expired contacts and prohibit unapproved wiping, rebuilding, public statements, or sensitive-data sharing.

- [ ] **Which instinct could destroy evidence?**

  Notes: ________________________________________________

- [ ] **Which communication channel is approved?**

  Notes: ________________________________________________

## 05 / Prove — Exercise and maintain

Tabletop the contact path, retain results, fix gaps, and reopen after provider, system, owner, policy, or insurance changes.

- [ ] **Did every contact work?**

  Notes: ________________________________________________

- [ ] **What failed during the exercise?**

  Notes: ________________________________________________

## Completion check

- [ ] Approved contacts and escalation authority are current.
- [ ] Observations remain separate from incident conclusions.
- [ ] Preservation and communication instructions come from the organization's approved plan and advisers.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._