PCI ROC vs AOC (Attestation of Compliance) vs SAQ Explained

A PCI Report on Compliance (ROC) is the detailed assessment report a Qualified Security Assessor (QSA) writes after testing your controls. An Attestation of Compliance (AOC) is the short, signed declaration of the result that you share with your acquirer and customers. A Self-Assessment Questionnaire (SAQ) is the self-assessment smaller organisations complete instead of a ROC. Every ROC and every SAQ comes with an AOC.

This guide explains the three documents, who needs which, who signs them, how long an AOC lasts and how a ROC assessment runs under PCI DSS v4.0.1.

Key takeaways

• The ROC is the detailed report; the AOC is the summary you share.
• Level 1 merchants and Level 1 service providers need a ROC each year; most others complete an SAQ.
• Every SAQ and ROC is accompanied by an AOC, signed by your organisation and, where involved, the QSA.
• An AOC is generally treated as current for 12 months.
• Evidence must show controls operating throughout the year, not just on assessment day.

What is the difference between an SAQ, AOC and ROC?

The requirements are the same PCI DSS requirements in each case. The difference is who validates them and how deeply they are tested.

What is a PCI Attestation of Compliance (AOC)?

An Attestation of Compliance is, in the PCI SSC’s own definition, the official form for merchants and service providers to attest to the results of a PCI DSS assessment documented in an SAQ or a ROC. There are separate AOC templates for each SAQ type and for ROCs, in merchant and service provider versions. After a ROC you use one of two forms, the Attestation of Compliance for Report on Compliance for Merchants or the version for Service Providers; both, and every SAQ AOC, are free in the PCI SSC document library.

It records who you are, how you take payments and what was assessed, then states your status: compliant, non-compliant, or compliant with a legal exception where a law prevents a requirement being met. If any requirement is not in place, the AOC includes an action plan with target dates.

Who signs the AOC?

An officer of the assessed organisation signs to confirm the result. Where a QSA carried out or supported the assessment, the QSA signs too, and an Internal Security Assessor who took part is recorded. The signature is a personal commitment on behalf of the business, so senior sign-off matters.

How long is a PCI AOC valid?

PCI DSS validation is annual, so an AOC is generally treated as current for 12 months from its signature date. Your acquirer will ask for a new one each year, and customers of service providers usually check the date. Controls must operate throughout that period, and a significant change in the meantime can mean you need to revalidate.

Is an AOC a PCI certificate?

No. The PCI SSC does not issue certificates of compliance, and what people call certification is, in practice, a compliant AOC backed by an SAQ or ROC. Our guide to PCI DSS certification explains why vendor certificates are not PCI SSC documents and what acquirers and customers rely on instead.

What is a PCI Report on Compliance (ROC)?

The ROC follows the PCI SSC’s reporting template for v4.0.1. It has two main parts.

Assessment overview. A description of the business, the scope of the assessment and the cardholder data environment (CDE), including network and data-flow diagrams, an inventory of system components, locations, third-party service providers, quarterly scan results, and how the assessor sampled systems and evidence. If this section is weak, everything that follows is open to challenge.

Findings and observations. For every requirement, the assessor records a finding (In Place, Not Applicable, Not Tested or Not in Place) and describes the testing performed: documents reviewed, people interviewed, configurations examined and what was observed. Where you used a compensating control or the customised approach, the supporting documentation and the assessor’s testing are included.

Who needs a ROC and who can use an SAQ?

The payment brands set the rules and your acquirer confirms what applies. The usual ROC triggers are:

• Level 1 merchants: under Visa and Mastercard definitions, more than six million transactions a year for that brand, plus any merchant designated Level 1, for example after a breach.
• Level 1 service providers: more than 300,000 transactions a year for a brand, plus every VisaNet processor and the provider types Mastercard places at Level 1 whatever their volume, such as Third Party Processors.

Level 2 to 4 merchants usually complete an SAQ, although some brands attach conditions. Mastercard, for example, requires Level 2 merchants completing SAQ A, A-EP or D to engage a QSA or a PCI SSC-certified ISA for validation. Our guide to PCI compliance levels sets out the thresholds, and our guide to which PCI SAQ you need covers the SAQ types. For a quick first answer, our free PCI compliance check suggests your likely SAQ.

Some organisations below Level 1 choose a ROC anyway because their customers want independent assurance. That is common for service providers, whose customers must check their providers’ compliance status every year.

How does a ROC assessment work?

1. Scoping. Scope determines everything else. The CDE includes every system that stores, processes or transmits cardholder data, plus anything connected to it or able to affect its security. Requirement 12.5.2 asks you to confirm scope at least every 12 months; service providers do so every six months.
2. Gap analysis and remediation. A gap analysis several months before the assessment finds what must change while there is still time. Our PCI DSS consultancy runs these, kept separate from the assessment itself, and our guide to PCI DSS gap analysis explains what is involved.
3. Evidence collection. Organise evidence by requirement: policies, configuration standards, logs, change records, access reviews, training records, risk analyses, and scan and penetration test reports. Our guide to PCI documentation sets out the policies, procedures and evidence a QSA expects for each requirement. Evidence also includes four quarters of passing ASV scans and annual PCI DSS penetration testing, with segmentation testing if you rely on segmentation.
4. Fieldwork. The QSA reviews documents, examines configurations, samples evidence and interviews the people who run the controls, remotely, on site or both.
5. Reporting and quality assurance. The QSA writes the ROC, which goes through the QSA company’s internal quality review before the ROC and AOC are signed and submitted as your acquirer or the brands direct.

If you have not yet appointed an assessor, our guide on how to choose a PCI QSA explains how to verify one on the PCI SSC list and what to ask before you sign.

What should executives watch?

• Ownership. v4.0.1 requires documented roles and responsibilities for every requirement. Give each a named owner.
• Targeted risk analyses. Where you set your own frequency for a control, the analysis must be documented and reviewed annually.
• Third parties. Keep a current list of service providers, their AOCs and which requirements each covers.
• Continuous operation. Six-monthly access reviews, log review and payment page change detection must run all year. Missed cycles become findings, and gaps in this evidence are among the most common PCI audit failures.
• Budget. Assessment effort scales with scope. Our guide to PCI compliance cost explains the drivers.

How Sovereign Secure can help

Sovereign Secure is a PCI SSC-approved QSA company. Our PCI compliance audit service delivers the ROC and AOC for merchants and service providers, from scoping to the signed attestation, and we support organisations completing QSA-signed SAQs. As a Qualified PIN Assessor and Card Production Security Assessor, we can plan related PCI assessments alongside it.