PCI Requirements 101

**Executive Summary:** This guidance outlines practical steps for Qualified Security Assessors (QSAs) to complete PCI-DSS Reports on Compliance by focusing on three recurring components—Documentation (policies, standards, procedures), Observations/Evidence (screenshots, scripted outputs, onsite observations), and Interviews—and provides a list of typical policy documents and evidence best practices to satisfy PCI requirements.