---
tool_id: WACK-TOOL-0003
concept_id: WACK-CONCEPT-0008
playbook_content_id: WACK-CONTENT-0022
status: draft
technical_review: pending
artifact_type: working_worksheet
---

# TPSP Responsibility Map

> Replace “the vendor handles it” with explicit provider, customer, and shared activities.

**Expected output:** A service-level responsibility and evidence map with monitored handoffs.  
**Working time:** 60 minutes  
**Derived from:** WACK-CONTENT-0022

## Working context

Organization / environment: __________________________________________  
Facilitator / owner: __________________________________________________  
Participants: _________________________________________________________  
Date: ____________________  Review trigger or next date: ______________

## 01 / Find — Name the consumed service

Start with the exact service and deployment model in use.

- [ ] **Which provider services are used within or related to the environment?**

  Notes: ________________________________________________

- [ ] **Do contracts, architecture names, service documentation, and validation coverage identify the same service?**

  Notes: ________________________________________________

## 02 / Map — Decompose the activities

Assign performance at the activity and configuration seam.

- [ ] **What does the provider perform, what does the customer perform, and what is shared?**

  Notes: ________________________________________________

- [ ] **Who configures, operates, monitors, retains evidence, and responds to failures?**

  Notes: ________________________________________________

## 03 / Explain — Reconcile responsibility and coverage

Connect the map to current contractual and validation records.

- [ ] **What evidence demonstrates each relied-upon provider activity?**

  Notes: ________________________________________________

- [ ] **Which customer duties or shared seams are absent from the responsibility record?**

  Notes: ________________________________________________

## 04 / Reduce — Close the seams

Remove ambiguity, unused services, and unsupported reliance.

- [ ] **Which responsibility has no owner or available evidence?**

  Notes: ________________________________________________

- [ ] **Which unused permission, service, integration, or duplicated activity can be removed?**

  Notes: ________________________________________________

## 05 / Prove — Monitor the relationship

Define how responsibility and status remain current.

- [ ] **Who reviews service, coverage, responsibility, and evidence changes?**

  Notes: ________________________________________________

- [ ] **What event or review cycle triggers reassessment of the map?**

  Notes: ________________________________________________

## Completion check

- [ ] Every relied-upon activity is provider, customer, or shared.
- [ ] Every activity names its evidence source.
- [ ] Every handoff has a change and failure owner.

## Decision and next action

Decision: _____________________________________________________________  
Owner: __________________________  Due date: ___________________________  
Evidence or artifact location: ________________________________________

---

_Working practitioner worksheet pending technical review. It does not determine PCI DSS compliance, replace the standard, or replace instructions from an assessor or compliance-accepting entity. The Cluster of Wack is an independent resource and is not affiliated with or endorsed by PCI SSC._