If you’re new to PCI compliance, or even if you’re a seasoned expert, there are many different acronyms to remember when researching the best assessor to handle your report. From AOC, ROC, to SAQ – let’s define the alphabet soup of PCI reporting.
Defining PCI Reporting: SAQ, ROC, AOC
Did you know that the PCI DSS was actually a collaboration between the major credit card companies? The goal was to create standards around payment method security and is often used in conjunction with other data security standards.
- SAQ – A Self-Assessment Questionnaire is a series of yes-or-no questions designed to assess an entity’s compliance with the PCI DSS. A SAQ is typically utilized as a self-validation tool by small scale merchants or service providers. That being said, it is still important to work through these questions with an assessment professional to ensure that all necessary standards are met.
- ROC – A Report on Compliance is a type of form that is used to verify a merchant’s compliance with PCI DSS. These forms are required for Level 1 Merchants. Level 2 Merchants may also be required to complete an ROC, based on circumstance.
- AOC – An Attestation of Compliance is one part of the SAQ or ROC. This form allows merchants or service providers to attest to the final results of a PCI assessment.
Your Trusted PCI Partner
When you’re ready to engage a PCI QSAC for an AOC, ROC, or SAQ, look no further than Auditwerx. We have offered PCI compliance reporting to businesses of all sizes for over 10 years.
Our experienced assessors are here to help you simplify PCI reporting, from remediating gaps during your readiness assessment to providing the guidance needed for a successful compliance engagement.
