PCI Card Production and Provisioning Report on Compliance Template - Version 2.0 - December 2017

Sep 1, 2026

Upload by Aurelia

Payment Brand Assessors use this reporting template to complete a Report on Compliance (ROC) for assessments aligned to the PCI Card Production and Provisioning Physical Security Requirements v2.0. The template standardizes how compliance results are declared and how reporting instructions, tables, and required details are presented. It supports consistent evidence summaries derived from assessor work papers, including findings, testing activities, methodology context, and documented compliance status across each physical security requirement.

LanguageEnglish

CategoryForms

FormatDOCX

Pages184

Reading Time1 h 4 min

AccessFree to download

Introduction to the ROC Template

ROC Sections

ROC Vendor Self-Evaluation

ROC Summary of Assessor Findings

ROC Reporting Details

Do’s and Don’ts: Reporting Expectations

ROC Template for PCI Card Production and Provisioning Security Requirements v2.0

1. Contact Information and Report Date

2. Summary of Non-Compliance Findings

3. Inspection Overview

4. Validating the Requirements

5. Findings and Observations

Appendix B: Logical Security Requirements – CCTV and Access Control System Administration

Payment Card Industry (PCI) Card Production and Provisioning Report on Compliance FORMTEXT Enter company name FORMTEXT Enter city name, FORMTEXT Enter country name FORMTEXT Enter Assessor company name For use with Physical Security Requirements v2.0 Version FORMDROPDOWN December 2017 Document Changes Table of Contents TOC \o "1-3" \h \z Document Changes PAGEREF _Toc365552844 \h i Introduction to the ROC Template PAGEREF _Toc365552845 \h 1 ROC Sections PAGEREF _Toc365552846 \h 2 ROC Vendor Self-Evaluation PAGEREF _Toc365552847 \h 2 ROC Summary of Assessor Findings PAGEREF _Toc365552848 \h 3 ROC Reporting Details PAGEREF _Toc365552849 \h 4 Do’s and Don’ts: Reporting Expectations PAGEREF _Toc365552850 \h 4 ROC Template for PCI Card Production and Provisioning Security Requirements v2.0 PAGEREF _Toc365552851 \h 5 1. Contact Information and Report Date PAGEREF _Toc365552852 \h 5 1.1 Contact Information PAGEREF _Toc365552853 \h 5 1.2 Location, Date, and Timeframe of Assessment PAGEREF _Toc365552854 \h 6 1.3 Card Production Activities PAGEREF _Toc365552855 \h 6 1.4 Card (Mobile) Provisioning Activities PAGEREF _Toc365552856 \h 7 2. Summary of Non-Compliance Findings PAGEREF _Toc365552857 \h 8 2.1 Non-Compliance Findings – Example PAGEREF _Toc365552858 \h 8 2.2 Non-Compliance Findings – Detail PAGEREF _Toc365552859 \h 9 3. Inspection Overview PAGEREF _Toc365552860 \h 11 3.1 Facility Description PAGEREF _Toc365552861 \h 11 3.2 Documentation Reviewed PAGEREF _Toc365552862 \h 12 3.3 Individuals Interviewed PAGEREF _Toc365552863 \h 14 4. Validating the Requirements PAGEREF _Toc365552864 \h 16 5. Findings and Observations PAGEREF _Toc365552865 \h 17 Section 2: Roles and Responsibilities PAGEREF _Toc365552866 \h 17 Section 3: Premises PAGEREF _Toc365552867 \h 38 Section 4: Production Procedures and Audit Trails PAGEREF _Toc365552868 \h 113 Section 5: Packaging and Delivery Requirements PAGEREF _Toc365552869 \h 140 Section 6: PIN Printing and Packaging of Non-personalized Prepaid Cards PAGEREF _Toc365552870 \h 157 Appendix B: Logical Security Requirements – CCTV and Access Control System Administration PAGEREF _Toc365552871 \h 164 Introduction to the ROC Template This document, the PCI Card Production and Provisioning Template for Report on Compliance for use with PCI Card Production and Provisioning Physical Security Requirements v2.0 (“ROC Reporting Template”), is the template for Payment Brand Assessors completing a Report on Compliance (ROC) for assessments against the PCI Card Production and Provisioning Physical Security Requirements v2.0. The ROC Reporting Template serves two purposes: It serves as a declaration of the results of the card vendor’s assessment of compliance with the PCI Card Production and Provisioning Physical Security Requirements v2.0. It provides reporting instructions and the template for assessors to use. This can help provide reasonable assurance that a consistent level of reporting is present among assessors. Contact the requesting payment brand for reporting and submission procedures. Use of this reporting template is subject to payment brand stipulations for all Card Production and Provisioning v2.0 submissions. Tables have been included in this template to facilitate the reporting process for certain lists and other information as appropriate. Additional appendices may be added if the assessor feels there is relevant information to be included that is not addressed in the current format. However, the assessor must not remove any details from the tables provided in this document. Do not delete any content from any place in this document, including this section and the versioning above. These instructions are important for the assessor as the report is written and for the recipient in understanding the context from which the responses and conclusions are made. Addition

FAQs

What is the purpose of the ROC Reporting Template for PCI Card Production and Provisioning?

It declares the card vendor’s assessment results against the PCI Card Production and Provisioning Physical Security Requirements v2.0 and provides reporting instructions and a standardized template for assessors.

Who uses the ROC Reporting Template and what work does it support?

Payment Brand Assessors complete the ROC during onsite card production and provisioning assessments. The ROC summarizes evidence from assessor work papers, including testing activities and documented findings.

Which sections must be completed before Section 5 findings and observations?

Sections 1 through 4 must be thoroughly and accurately completed so that the Section 5 assessment findings have proper context.

Sep 1, 2026

Upload by Aurelia