MB-R093

AUTOMATED PCI manual evidence checklist present

MB-C07 Logging & Monitoring Low

PCI evidence documentation covers payment scope, SAQ notes, access review, incident response, and vendor responsibilities.

Why it Matters

Some PCI readiness evidence cannot be inferred from code alone. Teams still need diagrams, script approvals, access reviews, provider responsibility notes, incident procedures, and review cadence evidence.

A manual evidence checklist prevents audit surprises and gives merchants or agencies a practical way to prove how payment security is maintained over time.

Verification Steps

Evidence file check

# Look for PCI readiness evidence in repo or documentation
find . -iname "*pci*" -o -iname "*payment*evidence*" -o -iname "*checkout*script*"

Checklist review

Confirm evidence covers payment flow diagrams, script inventory, access review, key rotation, incident response, and quarterly review

Remediation / Fix Guidance

Create a PCI readiness checklist for items automation cannot prove.
Attach payment flow diagrams, provider responsibilities, checkout script approvals, and access review notes.
Assign owners and review dates to each evidence item.
Keep evidence updated when payment modules, checkout scripts, or providers change.
Store evidence where release and maintenance teams can find it.

Examples

Fail Example

No documented payment flow, script approval, access review, or evidence owner.
# Manual evidence missing → FAIL

Pass Example

docs/pci-readiness.md includes owners, dates, payment flow, script inventory, and review evidence.
# Checklist present → PASS