An approved version never changes
A late change is shown, never absorbed.
Write
A report you can trace,sentence by sentence
The report is waiting
when testing ends
The Report on Compliance (ROC) and its Attestation of Compliance (AOC) are drafted the same day. Your lead reads every sentence before it counts.
10.2.1.aAssessor's response
Audit logs are enabled on all in-scope servers, per EV-074 lines 112 to 124 EV-074
Drafted by Enpasse
Accepted by Maria Reyes, 16 Oct, 15:02
PCI's template,
already answered
Drag across the page. The same ROC rows, blank on the left and drafted on the right.
10.2.1
Audit logs are enabled and active for all system components and cardholder data.
Assessment Finding
In PlaceNot ApplicableNot TestedNot in Place
Describe why the assessment finding was selected
Audit logging is enabled on all 42 in-scope servers and the payment database, and cannot be turned off without an approved change. EV-021Int-7
10.2.1 Identify the evidence reference number(s) from Section 6 for all system components examined
Evidence-14 Evidence-15
Describe how the audit log settings examined verified that logs are enabled and active
The assessor examined the log collector configuration export and confirmed audit logging is enabled for every host group. EV-021
Identify the evidence reference number(s) from Section 6 for all interviews conducted
Int-7
Every heading kept, every row answered
Copper until your lead accepts. Section 6 numbers fill in by rule.
Drafted in the order
the report depends on
Once Assess is signed off, Enpasse drafts in three steps from the accepted results and testing notes. Each sentence cites the passage behind it, and your lead reviews every page.
The Report on Compliance contents page in print order: section 1, sections 2 to 6, section 7 by requirement, the appendices, then the Attestation of Compliance. Drafting runs in three steps: Foundation drafts sections 2 to 6 and the file list, Findings drafts section 7 and the appendices, and Summary drafts section 1 and the Attestation of Compliance last. Without AI, nothing drafts and every page opens for your lead at sign-off.
Section 1 prints first and drafts last
A file gets its number before a finding cites it. The summary waits for the findings.
Also in drafting
Three steps, in orderDrafting never runs ahead of what is settled.
Foundation drafts sections 2 to 6 and the file list. Findings drafts section 7 and the appendices. Summary drafts section 1 and the Attestation of Compliance last.Never accepted twiceA block from a record shows its home and stamp.
Dates, people and facts accepted in Scope or Assess print as they were accepted, with the name and date of that acceptance. A page built from your records is complete.Clean pages togetherAccept several at once, each stamped with Undo.
Pages whose every sentence cites its source can be accepted together. A page that needs a closer look stays out of the batch.Complete without AIZero model calls. Every step still works.
Nothing drafts. Every page opens for your lead at sign-off, and results, dates and facts still print from their records.
Follow any sentence
to the line it cites
Scroll to ride each citation from the page to its file. Three sentences, three sources, exact lines.
One page, three sentences, three sources
A drafted ROC page for 10.2.1 with three suggested sentences. Each one cites a source: the log collector configuration export, lines 112 to 118; an interview with the security operations lead; and page 6 of the logging standard. As you scroll, the view travels from each sentence to the exact cited lines and back.
Change a fact once.
Every page that prints it follows.
Facts print from the accepted record, never typed twice.
One record, every page that shows it
A service provider added in Scope prints in 4.4 and the AOC's 2f.
Every file number
stays in step
Section 6 lists the files testing used, and section 7 cites each by number. Enpasse keeps the two in step and your lead decides every entry. A given number never changes.
Checked across the report.
Approved by a person.
Enpasse checks the Report on Compliance and its Attestation of Compliance together, showing each problem on the page where it is. Your lead fixes it, then approves both in one act.
Sections 1 to 6, three requirement chapters of section 7 and the Attestation of Compliance shown small, each line one sentence, coloured by what it rests on: a passage in a file, an interview, a record, or the lead's own words. Checks across the report mark each problem on its page, and a check that spans two sections shows on both.
Zoom out, and every sentence shows where it rests
Point at any page to read its sources. Each problem shows on its page in words, and fixing either side of a check clears both.
QA that sees how
each block was decided
A reviewer who took no part checks the approved version, view only. She edits wording or sends a page back with a reason, and your lead answers each one.
The next round checks only what changed
An edit accepted as written comes back checked.