Sign in Apply for early access
Firm library

Every assessment startsfrom your method

Requests, questions, tasks and report style, written once and versioned. Live work keeps its version.

See how versions travel

Written once. Pinned per assessment. A new version never moves live work.

RequestsMeridian service providers
  1. v1Imported2 Sep
  2. v2Kinds added14 Sep
  3. v34 added, 2 reworded2 Oct
  4. v43 added, 1 no longer offered, 2 reworded6 Oct
Maria Reyes, 2 Oct
Northwind RetailRequests v3
ER-6System hardening standards
ER-7Quarterly internal scans
ER-62Segmentation test results
ER-63Key custodian sign-offs
ER-64Payment page script inventory
v4Keep v3Use v4
MRv4+3 requests
Harbor PaymentsRequests v3
ER-6System hardening standards
ER-7Quarterly internal scans
v4Keep v3Use v4
Orrin LogisticsRequests v3
ER-6System hardening standards
ER-7Quarterly internal scans
v4Keep v3Use v4
A new assessmentRequests v4
Firm default

Every live assessment pins v3

Three leads, one set of requests.

A year of assessments, one library. Pick a version to see who holds it.

Report styleMeridian standard

Import the lists you already keep. Columns map, flagged rows wait, the rest lands as a draft.

Your report style, on every page. Start from PCI's default, your style, or a Report on Compliance you delivered.

Measured from Northwind Retail ROC 2025.docx
Requirement narrative60 to 220 wordsMeasured
Section 6 listsDoc-01Measured
Technical depthStandardPCI default

The same fields, two styles.

Report previewNorthwind Retail ROC 2026
Meridian Assurance, Report on CompliancePage 4
1.1.1

The assessor examined the network security policy, version 1, which covers every Requirement 1 topic.

1.4

Meridian Assurance provided no products or services to Northwind Retail other than this assessment.

1.5

Meridian Assurance used no subcontractors for this assessment.

6.1

Evidence is kept in Enpasse for at least 3 years, then in the Meridian workpaper archive.

6.4

Doc-01 Network security policy and roles, version 1.

One template for
every narrative

Fixed words, your rules, citations after each claim. Approved pages keep their words.

Narrative, In PlaceSection 7
Opening words

For Sub-requirement, the assessor examined the files below.

Enpasse AI suggests A place the QSA writes
1 to 3 paragraphs60 to 220 words in allProfessionalAs the assessor
Must use examinedNever use utilize
Citations

After each claim Doc-1 Int-2

Ending words

On this evidence, Sub-requirement is Result word.

Meridian standard v4Northwind Retail uses v3
2.2.1

The assessor reviewedexamined the hardening standard against each system type in the asset list.

1.2.7

The assessor readexamined the signed review for March 2026.

Keep v3Use v4

Move the start. Every date follows. Date rules become real days on each assessment.

TasksMeridian onsitev2Preview: Northwind Retail ROC 2026
7 tasksDrag Start, Onsite or End

Preview on a real assessment

A task list missing a PCI duty is refused.

Also in the library

  • QSAs draft, admins publishAssociates read.
    A QSA prepares a draft version. Only an admin publishes it to the firm. Associates read every item and change none.
  • Every version keptWho published it, and when.
    Each version stays in History with its name and date. Live assessments keep the version they pinned.
  • Complete without AIImport suggestions are the only model call.
    Without AI, map imported rows by hand. Everything else in the library works the same.
  • Six items, one wayEach versioned the same.
    Evidence requests, scoping questions, tasks, sample sizes, report styles and the QA checklist. Each is drafted, published and pinned the same way.
RequestsEvery missing file, requested in plain words. WriteThe ROC, drafted page by page. TasksThe work, from kickoff to Export.

Write it once as a firm.
Start every assessment from it.

Apply for early access See Enpasse for firms