PCI DSS ROC and AOC Explained: Report vs Attestation of Compliance

Assessment Flow

1. Confirm the scope of the PCI DSS assessment
2. Perform the assessment of the environment
3. Complete the applicable report (ROC Template or SAQ)
4. Complete the applicable AOC in its entirety (official AOCs only from PCI SSC)
5. Submit documentation and AOC (plus requested artifacts such as ASV reports) to the requesting organization
6. Remediate open items and provide an updated report if required

Who Typically Needs What

• ROC + AOC: Entities required by payment brands or acquirers to undergo an assessment producing a ROC (commonly Level 1 merchants and many Level 1 service providers). Exact volume thresholds are brand-specific - confirm with your acquirer and see the compliance levels page.
• SAQ + AOC: SAQ-eligible entities completing the matching SAQ; the AOC is part of the SAQ package (Sections 1 and 3 in v4.x SAQs).

QSAs typically perform ROC assessments. ISAs support their employer's internal program; they are not a substitute public QSA credential.

How CyberSilo Helps

• QSA-ready evidence packages via CSA
• Continuous control status so ROC fieldwork is sampling verification, not discovery
• AOC preparation checklists mapped to open findings

Frequently Asked Questions

Is an AOC alone proof of compliance?

It attests to assessment results documented in a ROC or SAQ. Requesters usually want the paired report or questionnaire and supporting artifacts such as ASV scan reports.

Can an ISA sign a ROC for any company?

ISA qualification is for the sponsor employer's assessments under the ISA program - not a general public QSA credential. ROC assessments for third parties require a QSA Company.

Do SAQs include an AOC?

Yes. Each SAQ includes Attestation of Compliance sections aligned with ROC AOC structure for v4.x.

Related PCI Resources

SAQ vs ROC · SAQ D · QSA vs ISA vs ASV · ASV scans · PCI hub