---
tool_id: WACK-TOOL-0019
concept_id: WACK-CONCEPT-0008
playbook_content_id: WACK-CONTENT-0099
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# TPSP Deferral Claim Brief

> Turn ‘the provider handles it’ into one bounded statement a QSA can test.

**Expected output:** A service-and-activity deferral brief with provider evidence, customer duties, residual controls, limitations, and monitoring.  
**Working time:** 45 minutes  
**Derived from:** WACK-CONTENT-0099

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Name the exact reliance

Replace vendor shorthand with a configured service and performed activity.

- [ ] **Which provider, service, feature, account, region, environment, activity, population, and period are claimed?**

  Notes: ________________________________________________

- [ ] **Where does that statement appear in workpapers, responsibility records, and reporting?**

  Notes: ________________________________________________

## 02 / Map — Join responsibility to evidence

Connect provider, customer, and shared activities to what proves each one.

- [ ] **Does current provider assessment scope cover the consumed service and relied-upon requirements?**

  Notes: ________________________________________________

- [ ] **Which customer systems, controls, owners, and tests remain at every handoff?**

  Notes: ________________________________________________

## 03 / Explain — Write the testable sentence

Use a stable claim form without treating the form as an assessment result.

- [ ] **Can the claim name provider performance, environment, period, evidence, customer duties, and residual monitoring in one sentence?**

  Notes: ________________________________________________

- [ ] **Which limitation must travel with the statement into reporting?**

  Notes: ________________________________________________

## 04 / Reduce — Remove ambiguous reliance

Close responsibility seams and unsupported provider assumptions.

- [ ] **Which provider activity lacks sufficient evidence or an exact owner?**

  Notes: ________________________________________________

- [ ] **Which unused service, duplicated control, or overbroad report statement can be removed?**

  Notes: ________________________________________________

## 05 / Prove — Keep the claim current

Bind the statement to monitoring and reopening triggers.

- [ ] **Who monitors provider status, scope, service, responsibility, and evidence changes?**

  Notes: ________________________________________________

- [ ] **What happens when evidence lapses, a service changes, a control fails, or the provider cannot substantiate coverage?**

  Notes: ________________________________________________

## Completion check

- [ ] The exact provider service and activity are named.
- [ ] Provider evidence and customer testing are connected.
- [ ] Limitations, monitoring, and reopening triggers are owned.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._