Payment Data and PCI Evidence Review

When to Use

Review payment data flows, prepare engineering controls or collect evidence for a scoped PCI assessment. This skill does not certify compliance or determine assessment eligibility on its own.

Inputs and prerequisites

Identify the merchant/service-provider role, acquiring institution, processor integration, systems handling account data and the applicable assessment documents. Obtain the current documents from the PCI SSC document library; confirm applicability with the responsible assessor or acquiring institution.

Procedure

1. Follow resources/implementation-playbook.md to map forms, APIs, storage, queues, logs, telemetry, backups and support exports.
2. Prefer provider-hosted collection when appropriate. Verify what the application actually receives; a tokenization claim does not prove that raw account data never reaches another system.
3. Minimize retained data and document purpose, access, retention and deletion. Do not retain sensitive authentication data after authorization, even encrypted. Do not build a custom card vault from an illustrative encryption snippet.
4. Map required controls to implementation evidence: network boundaries, system configuration, data protection, access, monitoring, testing and operational ownership. Keep unverified controls marked as gaps.
5. Use allowlisted event fields in logs and responses. Test nested errors and retries with synthetic data; denylist filtering cannot anticipate every sensitive field name.
6. Verify role and resource authorization together. A broad payment role does not grant access to every customer's payment method.
7. Produce a control/evidence/gap/owner table and remediation plan. Treat SAQ eligibility, transaction thresholds and formal attestation as decisions requiring the applicable current guidance.