PCI Documentation: The PCI DSS Policies, Procedures and Records QSAs Expect

PCI documentation is the written evidence that your card data controls are defined, owned and working: policies that say what must happen, procedures that say how, standards, diagrams and inventories that describe your environment, and records that prove each control ran. Every one of PCI DSS v4.0.1 Requirements 1 to 11 opens with the same two documentation checks, Requirement 12 adds the information security policy and the programme around it, and an assessor tests all of it against what your people actually do.

This page is the document view of PCI DSS. For the controls themselves, work through our PCI compliance checklist.

Where do you download the PCI DSS standard and SAQ documents?

From the PCI SSC document library, free of charge. The PCI Security Standards Council publishes every official PCI DSS document there; you accept a licence agreement before downloading.

None of these is written for you. The documents your assessor actually tests, your own policies, procedures, diagrams, inventories and records, are ones you write yourself, and the rest of this page lists them requirement by requirement.

What PCI DSS documents are needed for compliance?

Six kinds of document, in the quantity your scope demands:

A merchant on a short SAQ needs a handful of these; a service provider facing a full Report on Compliance needs all of them.

Which PCI compliance policies and procedures does each requirement need?

Each requirement needs its own documented policies and procedures, plus the specific documents below. Review cycles are those stated in PCI DSS v4.0.1; “TRA” means your own targeted risk analysis sets the frequency. All apply now: the future-dated requirements added in v4.0 became mandatory on 31 March 2025.

Requirement 12 as a whole is summarised in our guide to the PCI DSS requirements. To track this table as a working register, download the free PCI DSS document index (.xlsx), with owner, status and review-date columns for every row.

What do the x.1.1 and x.1.2 requirements ask for?

Requirements 1.1.1 to 11.1.1 say that the security policies and operational procedures for each requirement are documented, kept up to date, in use and known to all affected parties. Requirements 1.1.2 to 11.1.2, new in v4.0, say that roles and responsibilities for each requirement are documented, assigned and understood.

“In use”, “known” and “understood” are not tested by reading. A QSA will ask your firewall administrator how a rule change gets approved and compare the answer with the procedure. A responsibility matrix with one row per requirement is a straightforward way to show x.1.2, alongside 12.1.3 (all personnel acknowledge their security responsibilities) and 12.1.4 (a CISO or other knowledgeable executive is formally responsible for information security). Service providers also need executive responsibility for the programme (12.4.1) and quarterly checks that staff follow procedures (12.4.2).

How often must PCI policies be reviewed?

At least once every 12 months for the information security policy, and whenever business objectives or risks change (12.1.2). For the procedures in Requirements 1 to 11, the standard requires them to be kept up to date but sets no interval; reviewing them with the annual policy review, and after any significant change, is the approach we recommend.

Other documents carry their own 12-month cycle: targeted risk analyses (12.3.1), cipher suites and protocols (12.3.3), hardware and software technologies (12.3.4), the awareness programme (12.6.2), the incident response plan, which must also be tested (12.10.2), and each service provider’s compliance status (12.8.4). Record the owner, approver and review date on every document; an assessor wants evidence of the review even when nothing changed.

What evidence do QSAs ask for?

Assessors examine documents, interview staff, observe processes and test samples. Expect requests for:

• Network and data-flow diagrams that match a walk-through of the real environment (1.2.3, 1.2.4).
• Complete inventories of in-scope systems (12.5.1), user accounts, terminals and service providers. Samples are drawn from these, so a gap in a list undermines the sample.
• Records across the whole period, not just the week before fieldwork: four quarters of scans, the two latest six-monthly reviews, daily log review evidence and change tickets.
• Provider evidence: each service provider’s Attestation of Compliance and the written split of responsibilities (12.8.5).
• Customised approach documents, if you use that route: a controls matrix and a targeted risk analysis for each customised requirement (12.3.2).

The assessor samples systems, locations, changes and accounts and records why each sample is representative. To organise an evidence library before fieldwork, see how to prepare for a PCI DSS audit.

How long should you keep PCI evidence?

PCI DSS sets explicit retention periods for only a few records: audit logs for at least 12 months, with the most recent three months immediately available for analysis (10.5.1), and physical access monitoring data (camera or access control records) and visitor logs for at least three months, unless the law restricts it (9.2.1.1, 9.3.4). For other evidence, keep enough to show that each recurring activity ran throughout the assessment period.

For a first assessment, the notes to 11.3.2 do not require four passing quarterly external scans if the latest passed, quarterly scanning is documented and earlier findings were fixed and rescanned.

Evidence must never become a new store of card data. Mask PANs in screenshots and exports, and keep any account data only as long as your retention policy allows (3.2.1).

How does PCI documentation differ for an SAQ and a ROC?

The documents are largely the same; who tests them, and how deeply, is what changes. Your PCI compliance validation documentation, the part you actually submit, is short: the AOC, the SAQ or ROC behind it and, where your acquirer asks for them, your ASV scan reports. Everything else stays on file for your assessor.

An SAQ is still a signed statement, so the documents behind each “in place” answer must exist. Our guide to the PCI ROC explains the report and attestation, and our guide to which SAQ applies to you covers eligibility. For a quick first answer, take our free PCI compliance check. The PCI DSS v4.0.1 standard itself, with its testing procedures, is free from the PCI SSC document library.

Is there a PCI DSS policy template pack?

Templates are a starting point, not evidence of compliance. The core policy set most organisations need:

• Information security policy with roles (12.1) and acceptable use (12.2.1)
• Network security and secure configuration (Requirements 1, 2)
• Data retention and disposal (3.2.1); cryptographic key management (3.6, 3.7)
• Malware and phishing protection (5)
• Secure development, vulnerability and change management (6)
• Access control and authentication (7, 8)
• Physical security, media and terminals (9)
• Logging and monitoring (10); security testing (11)
• Targeted risk analysis (12.3), awareness (12.6) and screening (12.7)
• Service provider management (12.8) and incident response (12.10)

Download the PCI DSS document index (Excel, free): one row per document for Requirements 1 to 12, a sheet for the cross-cutting documents (scope, inventories, diagrams, targeted risk analyses, incident response and service providers) and a sheet for the evidence to keep for the period. Questions about tailoring it? Ask through the enquiry form. If you would rather have the documents written for you, our PCI DSS consultancy writes policies and procedures fitted to how you work.

Where we both write your documents and are asked to assess you, advisory and assessment work are kept separate, as PCI SSC expects of a QSA company. Consultancy does not make an assessment easier, and you are free to use a different QSA.

Why use Sovereign Secure?

• Sovereign Secure Ltd is a PCI SSC-approved Qualified Security Assessor (QSA) company, and also holds the Council’s Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) approvals.
• A member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
• ISO 27001 certified, and an IASME-licensed Cyber Essentials certification body.
• Incorporated in 2012 and headquartered at 16 Whalley Road, Accrington, with offices in Los Angeles, Singapore, Dubai and Dhaka.

What should you do next?

Not sure your documents would survive an assessor’s interviews? A gap analysis will show you. If they are ready and your records cover the period, book your PCI compliance audit. Tell us your SAQ type or ROC date through the enquiry form, or call +44 161 523 5276.