The Report on Compliance is the definitive documentation of a Level 1 PCI DSS assessment. It is the deliverable that card networks, acquirers, and enterprise clients rely on to confirm that a service provider or Level 1 merchant has been independently assessed against the full PCI DSS requirements. Understanding what the ROC contains — and how it differs from a SAQ — is essential for organizations at every level of the PCI DSS ecosystem.
ROC vs. SAQ — Key Differences
| Aspect | Report on Compliance (ROC) | Self-Assessment Questionnaire (SAQ) |
|---|---|---|
| Who prepares it | Qualified Security Assessor (QSA) after independent assessment | Organization completes its own assessment (self-reported) |
| Required for | Level 1 merchants and service providers | Level 2–4 merchants and Level 2 service providers |
| Testing procedures | QSA performs detailed testing for each requirement | Organization self-attests to compliance |
| Independence | Independent third-party assessment | No independent verification |
| Evidence review | QSA reviews and cites evidence for each control | Evidence not reviewed by independent party |
| Market trust | High — independently verified | Moderate — self-reported |
| Cost | High — QSA professional fees | Low to moderate — internal staff time |
| Length | 100–300+ pages | 20–340 questions depending on SAQ type |
ROC Structure — What It Contains
Executive Summary
The executive summary provides an overview of the assessment scope, the QSA company and assessment team, the assessment timeline, the overall compliance status (compliant, compliant with compensating controls, or non-compliant), and a summary of findings.
Scope Description
Detailed description of the systems, people, and processes included in the assessment. Includes the CDE definition, network architecture overview, data flow summary, and description of any scope reduction measures (tokenization, P2PE, segmentation).
Requirement Testing Procedures and Results
The core of the ROC — a section for each of the 12 requirements (and their sub-requirements) documenting: the specific testing procedures the QSA applied, the evidence reviewed, the findings from testing, and the compliance determination (in place / not in place / not applicable / not tested).
| KEY IDEA | The ROC is not just a checklist of pass/fail results — it is a documented record of what was tested, how it was tested, and what evidence was reviewed. When an enterprise client or regulator reviews your ROC, they can see the specific testing procedures applied and the evidence cited. A well-documented ROC builds significantly more trust than one with sparse or generic descriptions. |
Compensating Controls Worksheets
If an organization cannot meet a requirement due to documented technical or business constraints, they may implement compensating controls. The ROC includes a Compensating Controls Worksheet for each such requirement, documenting the constraint, the compensating control implemented, how the compensating control addresses the objective of the requirement, and the QSA's assessment of whether the compensating control is sufficient.
Management Response to Findings
For any requirements found to be "not in place," the organization's management must provide a formal response in the ROC documenting: the nature of the gap, the remediation actions planned, the target completion date, and the person responsible. Findings with management responses allow organizations to receive a conditional ROC while remediating identified gaps.
How to Use the ROC
With Acquiring Banks and Card Networks
Submit the AoC (Attestation of Compliance — a one-to-two page summary signed by the QSA and organization management) to your acquiring bank. Card networks typically see the AoC, not the full ROC. The full ROC is retained by the organization and made available to card networks on request.
With Enterprise Clients
Enterprise clients and procurement teams requesting PCI DSS evidence should receive the AoC, not the full ROC. The full ROC contains detailed system configuration information that should not be shared broadly. If a client insists on the full ROC, an NDA should be in place first.
With Indonesian Regulators
Bank Indonesia and OJK may request evidence of PCI DSS compliance for payment system operators and licensed institutions. The AoC is the appropriate submission; the full ROC may be requested during supervisory reviews.
| IMPORTANT | The AoC has an expiration date — 12 months from the date the assessment period ended. Ensure your AoC is renewed before expiration. Acquiring banks and card networks track AoC expiration dates and will flag organizations with lapsed compliance. Many service provider agreements require valid AoC submission as an annual obligation. |
| Organizations that make the transition from SAQ to ROC validation often underestimate the difference in evidence quality required. QSAs testing for ROC will want to see evidence of actual control operation during the assessment period — not just policies and configurations. Start collecting ongoing evidence (monthly log review records, quarterly access review completions, scan reports) from the beginning of your compliance program, not just in the months before assessment. |