Appendix D: Explanation of Requirements Not Tested If the Tested” column was checked in the questionnaire, use this worksheet to explain why the “Not related requirement was not reviewed as part of the assessment. Describe which part(s) of the Requirement requirement was not tested Describe why requirements were not tested Examples: Requirement 12 Requirement 12.2 was the only This assessment only covers requirements in requirement tested. All other requirements Milestone 1 of the Prioritized Approach. from Requirement 12 were excluded. Requirements Only Requirement 9 was reviewed for this Company is a physical hosting provider 1-8, 10-12 assessment. All other requirements were and only physical security controls were excluded. considered for this assessment.
Appendix D: Explanation of Requirements Not Tested If the “Not Tested” column was checked in the questionnaire, use this worksheet to explain why the related requirement was not reviewed as part of the assessment. Requirement Describe which part(s) of the requirement was not tested Describe why requirements were not tested Examples: Requirement 12 Requirement 12.2 was the only requirement tested. All other requirements from Requirement 12 were excluded. This assessment only covers requirements in Milestone 1 of the Prioritized Approach. Requirements 1-8, 10-12 Only Requirement 9 was reviewed for this assessment. All other requirements were excluded. Company is a physical hosting provider and only physical security controls were considered for this assessment.
PCI-DSS-v3_2-SAQ-D_Merchant.docx