ROC (Report on Compliance)

A Report on Compliance (ROC) is the comprehensive document produced by a QSA (Qualified Security Assessor) as the formal output of a Level 1 PCI DSS assessment. It is the most detailed form of PCI DSS compliance documentation and is required for Level 1 merchants and Level 1 service providers. The ROC documents the assessment scope, the testing methodology applied to each PCI DSS requirement, the evidence reviewed, and the specific findings, requirement by requirement, across the entire assessment.

ROCs are substantial documents, a complete ROC for a large organization may run hundreds of pages, because they document every applicable PCI DSS control, the test procedures the QSA applied, and the specific evidence that satisfied each requirement. This level of detail serves several purposes: it provides a defensible record of the assessment, enables card networks and acquirers to independently verify the scope and rigor of the assessment, and gives the assessed entity a roadmap for maintaining and improving their compliance posture.

The ROC is completed using the PCI SSC's official ROC Reporting Template, which is updated periodically as PCI DSS versions change. QSAs are required to use the current template for all assessments. The ROC is accompanied by an AOC (Attestation of Compliance), which summarizes the findings and provides the formal attestation signatures.

Most ROCs are confidential documents shared only with the acquiring bank or card brand that requires them. However, service providers may be asked to share their ROC (or relevant portions of it) with enterprise merchant customers as part of vendor due diligence processes.