PCI-DSS Compliance AOC Form

PCI-DSS Compliance AOC Form

This Attestation of Compliance ("AOC") is executed by Merchant Name: , Merchant Address: and Qualified Security Assessor Firm Name: , Assessor Address: . Effective Date of Attestation: .

RECITALS

WHEREAS, Merchant engages in payment card acceptance and has systems, people, and processes that store, process or transmit cardholder data within the environment described in this document; and

WHEREAS, Assessor has conducted an assessment of Merchant's environment against the Payment Card Industry Data Security Standard (PCI DSS) using the assessment scope, methodology, and evidence described below; and

WHEREAS, the parties intend for this AOC to record the results of that assessment and the parties' respective attestations regarding compliance status as of the Effective Date.

NOW, THEREFORE, in consideration of the mutual covenants set forth below, the parties agree as follows:

1. Definitions

For purposes of this AOC, the following terms have the meanings given: "PCI DSS" means the Payment Card Industry Data Security Standard as adopted by the card brands; "Assessment" means the activities performed by Assessor to evaluate Merchant's compliance; "Scope" means the systems, people, processes and locations included in the Assessment as described in Section 2.

2. Scope of Assessment

Assessment Scope Description:

Assessment Period From: To:

PCI DSS Version Assessed: . Assessment Type: Report on Compliance (ROC) Self-Assessment Questionnaire (SAQ)

3. Assessment Methodology and Evidence

Assessor states that the Assessment was conducted using recognized testing techniques including documentation review, personnel interviews, configuration inspection, and sampling of compensating controls where applicable. Evidence collected and relied upon is retained by Assessor as part of the assessment record and is available to card brands or acquirers upon lawful request consistent with contractual obligations.

Systems and Components in Scope

4. Attestation of Compliance

Based on the Assessment performed and to the best of Assessor's professional knowledge, the signatory Assessor hereby attests that, as of the Effective Date, the portion of Merchant's environment identified in Section 2:

Compliance Status: Is compliant with PCI DSS requirements Is not compliant with PCI DSS requirements

Summary of Findings and Non-Compliance Items:

If remediation is required, attach a remediation plan and expected completion dates. Remediation Plan Attached: Yes

5. Representations and Warranties

Merchant represents and warrants that it has provided Assessor with full access to the in-scope environment, relevant personnel, documentation and evidence necessary to conduct the Assessment. Assessor represents and warrants that it conducted the Assessment in a professional manner and in accordance with applicable industry standards for security assessments.

6. Confidentiality

The parties acknowledge that Assessment reports and underlying evidence may include confidential information. Each party will protect such information using at least the same degree of care it uses to protect its own confidential information, and will not disclose confidential information except as required by law, card brand or acquirer contractual obligations, or as expressly permitted in writing by the other party.

7. Indemnification

Merchant agrees to indemnify, defend and hold harmless Assessor from claims, liabilities, losses or expenses arising from Merchant's negligence or willful misconduct that materially affects the Assessment or any representations made herein. Assessor agrees to indemnify Merchant for claims arising from Assessor's negligent or willfully wrongful conduct in performing the Assessment.

8. Limitation of Liability

Except to the extent prohibited by applicable law, neither party will be liable for indirect, incidental, consequential, special or punitive damages arising from this AOC or the Assessment. Each party's aggregate liability under this AOC will be limited to direct damages up to the amount paid for assessment services, except for liabilities arising from willful misconduct or gross negligence.

9. Notices

10. Amendments; Waiver

Any amendment or modification of this AOC must be in writing and signed by authorized representatives of both parties. Failure to require strict performance of any provision will not waive that provision or any other rights.

11. Governing Law; Venue

This AOC will be governed by and construed in accordance with the laws of the jurisdiction specified by Merchant's principal place of business. Any disputes arising under or in connection with this AOC will be resolved in the courts of that jurisdiction unless the parties agree otherwise in writing.

12. Entire Agreement; Severability; Counterparts

This AOC, together with any attachments and the Assessment report referenced herein, constitutes the entire agreement between the parties concerning the subject matter and supersedes all prior agreements and understandings. If any provision is held invalid, the remainder will remain in full force. This AOC may be executed in counterparts and by electronic signature, each of which will be deemed an original.

13. Administrative Details

Acknowledgment

The undersigned representatives certify that they are authorized to execute this AOC on behalf of the named party and that, to the best of their knowledge, the information contained in this AOC and any accompanying Assessment report is true, accurate and complete as of the Effective Date.

Sign Now