What is the Purpose of Compliance Attestation?

PCI DSS is a crucial framework for businesses handling cardholder data, mandating annual assessments to verify compliance. 

Assessments encompass three main components: 

• The Self-Assessment Questionnaire (SAQ),
• Attestation of Compliance (AoC), and
• Report on Compliance (RoC). 

The choice of assessment method depends on the organization’s merchant level, which is classified based on transaction volume. There are four merchant levels: 

• Level 1 (over 6 million transactions annually)
• Level 2 (1-6 million transactions)
• Level 3 (20,000-1 million online transactions,, ns)
• Level 4 (less than 20,000 online transactions or less than 1 million transactions annually).

Merchant levels dictate the required assessments. 

• Level 1 necessitates an annual on-site assessment by a Qualified Security Assessor (QSA), leading to AoC and RoC. 
• Levels 2-4 typically require SAQ and AoC, with RoC not usually mandated. 

The SAQ types vary, targeting specific business models. The PCI attestation of compliance is a documented affirmation of adherence to PCI DSS standards corresponding to the completed SAQ. While Level 2-4 merchants can complete their AoC, Level 1 merchants often rely on a QSA for validation tied to the RoC results.

The Purpose of an AoC

The attestation report within the PCI DSS framework is meant to serve as a documented affirmation by an organization regarding its adherence to PCI DSS standards. After completing the Self-Assessment Questionnaire (SAQ), organizations fill out the corresponding version of the security attestation of compliance to attest to the accuracy of their self-assessment and declare their compliance status.

For Level 2-4 merchants, the PCI DSS attestation of compliance holds significant importance, representing a vital document that attests to their compliance status. While these organizations can independently complete the AoC, some may opt for validation or guidance from experienced PCI DSS specialists to ensure meticulous adherence to security standards. 

Conversely, Level 1 merchants undergo a more rigorous process where an independent Qualified Security Assessor (QSA) validates their compliance during a comprehensive assessment, culminating in the creation of a detailed Report on Compliance (RoC). In this scenario, the attestation of the compliance document is derived from the results of the RoC, providing an additional layer of assurance and validation to their compliance status.