The documentation and calendar behind PCI DSS: the policies each requirement expects, roles and responsibilities, the daily to annual tasks assessors check, network and data-flow diagrams, and the inventories the standard requires.
The written policies PCI DSS expects and how assessors test them: the policy and procedure sub-requirement in each of the 12 requirements, the information security policy and its annual review, acceptable use, retention, incident response and provider agreements.
Assigning PCI DSS responsibilities so assessors can verify them: roles per requirement, the executive with security responsibility, service providers' compliance program and quarterly reviews, key custodian acknowledgments and small-team role separation.
The recurring activities PCI DSS fixes by frequency: daily log review, weekly file comparisons, seven-day payment page checks, quarterly scans and retention checks, six-monthly reviews, annual testing and training, and what happens when one is missed.
What the network and data-flow diagrams in Requirement 1.2 must show, how they feed annual scope confirmation and the system inventory, infrastructure as code as configuration, and when significant change forces an update.
The inventories an assessor will ask for: in-scope system components, bespoke and third-party software, trusted keys and certificates, payment page scripts, cryptographic architecture, cipher suites, wireless access points, media and POI devices.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.