04-06-12 | Blog Post
If your company collects, transmits, stores or processes credit cardholder data, you will need to create a PCI DSS Report on Compliance at least annually for on-site assessments or self-reporting questionnaires. To sustain ongoing compliance after the initial point-in-time assessment, your company needs to design and implement a set of controls specific to PCI and security.
The PCI Security Standards Council provides a template for an attestation of compliance:
Description of Scope of Work and Approach Taken
Details About Reviewed Environment
Contact Information and Reporting Date
Quarterly Scan Results
Findings and Observations
When it comes to documenting details about your reviewed environment, any of your managed service providers/PCI hosting providers should be able to produce their own attestation of compliance report to inform your company about their controls and security. This can save you the time it takes to review and report on their compliance as it affects your company and cardholder data.
PCI DSS Quick Reference Guide (Version 2.0) (PDF)