PCI SSCPCI DSSCompliance ReportingEASYFree question
What is an Attestation of Compliance (AOC)?
- A.A scan summary signed by the ASV and the merchant attesting to the external network's vulnerability status
- B.A summary document signed by the organization and QSA attesting to the organization's compliance status
- C.A detailed workbook completed by the acquirer and card brand recording each merchant's validation deadlines
- D.A certificate issued by the PCI SSC and the acquirer confirming the merchant's approved payment applications
Why B is correct
The AOC is a formal attestation signed by both the assessed entity and the QSA confirming the scope, methodology, and results of the PCI DSS assessment.
Know someone studying for PCI DSS? Send them this one.