Compliance Validation, Assessments, and Evidence in Cloud
Compliance Validation, Assessments and Evidence in Cloud
This domain tests which validation path applies, what assessors accept as evidence, and how cloud changes validation.
Validation paths: a Report on Compliance (ROC) with an Attestation of Compliance (AOC) for larger merchants and service providers; a Self-Assessment Questionnaire (SAQ) for others, selected by how CHD is handled - for example SAQ A where all CHD is outsourced to validated providers, SAQ A-EP where your e-commerce pages can affect the payment page, and the D variants including SAQ D for Service Providers. Your acquirer determines what is acceptable. v4.0 adds the customized approach, where you design your own control against an objective and document a targeted risk analysis for each requirement met that way; the defined approach uses the standard requirements.
Cloud evidence: API and configuration exports with timestamps, infrastructure-as-code results, audit-trail extracts, the provider's AOC and published responsibility matrix, and your own change records. A control is assessed across a period, so a screenshot of one setting at one moment is weak; reproducible queries and continuous scans are strong. v4.0.1 (June 2024) clarified v4.0 without adding requirements, while the future-dated requirements became mandatory on 31 March 2025 - expect assessor scope to include them.
Worked example. The assessor asks for proof that no CDE security group allows RDP from the internet. The team supplies a screenshot of one group. That fails. A defensible answer: export every security group attached to in-scope interfaces, run a policy query enumerating rules permitting port 3389 from 0.0.0.0/0, show the timestamped output, and provide the automation running that check daily with drift alerts. Reasoning: the assessor needs completeness and repeatability, not one sample.
Traps. Presenting a provider's AOC as your own compliance; assuming a penetration test report substitutes for a ROC; forgetting customization documentation when using the customized approach; evidence dated outside the assessment period.