The scope, settled onceand cited line by line
Scoping is where assessments go wrong. Enpasse keeps the flows, systems, sites, providers and segments of the cardholder data environment in one record, each line on a cited file, and the lead QSA confirms it.
Scope is a map before it is a list. Every flow and boundary cites its file.
The boundary, proven by its test. Segmentation keeps other networks out of the cardholder data environment.
- Segmentation test
- Inside its window EV-014, verified by Maria Reyes, 2 Oct
- Crossings checked
- 4 of 4 paths into the CDE, each with the control that stops it
- Out of scope
- Corporate office, printed with its basis
The client's scope against yours. Switch records. Point at a difference to find it.
3 differences from the client's scope record
- AddedAnalytics replicaHolds card numbers, no column encryptionEV-047
- AddedCall center, LeedsAgents key phone ordersInt-07
- Out of scopeCorporate officeSegmentation verifiedEV-014
Differences go on the record
Each one prints in the scope confirmation, with the client's response beside it.
When files disagree, Enpasse picks no answer. The request is drafted from the question. Nothing is settled until the lead decides.
Every answer shows what it decides. A Yes rules nothing out. Unanswered stays Not yet known, never a quiet No.
Point at the answer, or press it, to see a No.A No drafts Not Applicable on each. Nothing counts until the lead accepts.
Change an answer, and its findings reopen
Enpasse asks the reason, then sends each finding it decides to Needs review.
Flip one answer. See what it decides. A No drafts Not Applicable. A Yes keeps the testing.
Point at a question to see the sub-requirements it decides.
Decided by rule, never guessed
A No drafts each Not Applicable reason for the lead to accept. A Yes rules nothing out.
The tables the report prints. Each row cites its file. Report pages edit the same rows.
Values print. Citations stay in Enpasse.
A value no file shows reads Not stated in the evidence, and the report holds until it is filled.
Also in Scope
Without AIEnter each answer with the Cite panel.
What an answer decides runs by rule, with zero model calls. The lead picks the file and the lines; the Not Applicable reasons draft the same way.On requestSuggestions run when the lead asks.
Never on upload, one run at a time. Each suggestion cites its file and waits for the lead to accept, edit or reject it.Site observationsWhat she saw on site, saved as a file.
An observation saves as its own file with a date and a name, and is cited like any other. The scope map and its answers can point to it.Current until sign-offA replaced file sends the answer to Needs review.
Before sign-off the answer reopens for the lead. After sign-off it shows Changed, and History keeps both versions.