AOC (Attestation of Compliance)

An Attestation of Compliance (AOC) is the formal document through which a merchant or service provider officially attests to the results of a PCI DSS compliance assessment. It is submitted to the acquiring bank or card brand to demonstrate that the organization has completed the required compliance validation process and that their environment meets the applicable PCI DSS requirements.

The AOC exists in two forms. For merchants and service providers undergoing a QSA assessment, the AOC is completed and countersigned by both the assessed entity and the QSA company, documenting the scope of the assessment, the validation method used, and the overall compliance determination. For merchants completing a SAQ (Self-Assessment Questionnaire), the AOC is a summary document accompanying the SAQ, signed by the merchant attesting to the accuracy of their self-assessment.

AOCs must be renewed annually, a current AOC is one completed within the past 12 months. Acquiring banks may request current AOCs as part of merchant onboarding, at regular intervals, or following a security incident. Service providers are typically required to maintain current AOCs and make them available to their merchant customers on request, as merchants rely on service provider AOCs as evidence that their payment chain partners are compliant.

The AOC does not guarantee security, it attests to compliance with a defined standard at a point in time. It is a necessary baseline, not a complete security posture.

Frequently Asked Questions

What is included in an AOC for a Level 1 merchant or service provider?

The Level 1 AOC documents the name and address of the assessed entity, the assessment date range, the QSA company and QSA individual who conducted the assessment, the scope of the assessment (including the payment channels and cardholder data environments covered), the PCI DSS version assessed against, and the overall compliance determination, compliant, compliant with exceptions, or non-compliant. It also includes a section for the assessed entity's executive to sign, attesting to the accuracy of the information.

Can a service provider share their AOC with merchant customers?

Yes, and responsible service providers do so proactively. Merchants are required by PCI DSS to manage the compliance status of their service providers, and an AOC is the primary evidence of a service provider's compliance. Service providers typically provide AOCs under NDA, limiting their distribution to authorized parties.

What is a "compliant with exceptions" AOC?

A "compliant with exceptions" finding means the QSA identified one or more requirements that were not fully met at the time of the assessment, but that the assessed entity has documented compensating controls or remediation plans that address the gap. This is different from non-compliant (where gaps are not remediated) and fully compliant (where all requirements are met without exceptions). Card networks and acquirers vary in how they treat compliant-with-exceptions status, some accept it as valid compliance, others require remediation before the next assessment.

AOC (Attestation of Compliance)

Frequently Asked Questions

What is included in an AOC for a Level 1 merchant or service provider?

Can a service provider share their AOC with merchant customers?

What is a "compliant with exceptions" AOC?

Related Terms

Insights and updates you actually care about