Step 1 of 6: Identity
PCI DSS v4.0.1
Phase 3 · Evidence & auditImmutable evidence collection, cryptographic hashing, freshness verification, and QSA review.
Basis: Evidence Management
/pci/evidencePayment Card Industry Data Security Standard (PCI DSS v4.0.1)
6 steps, completed in order. Each step is validated against the schema before the next unlocks.
Step 1 of 6
Complete the Identity fields. Each value is validated against the schema before the next step unlocks.
Artifact name (required)
artifactNameA name a reviewer will recognise months from now — not the raw filename.
Control id (required)
controlIdThe control or requirement this evidence supports — it is what makes the artifact attributable to a finding. e.g. 3.4.
Descriptionoptional
descriptionEnter description.
Step 2 of 6
Complete the Chain of custody fields. Each value is validated against the schema before the next step unlocks.
Artifactoptional
objectKeyUpload the evidence file. Its hash, size and type are computed from the stored bytes — you never type them.
Collected atoptional
collectedAtEnter collected at.
Collected byoptional
collectedByEnter collected by.
Step 3 of 6
Complete the Validity fields. Each value is validated against the schema before the next step unlocks.
Valid fromoptional
validFromDateEnter valid from.
Valid untiloptional
validUntilDateEnter valid until.
Step 4 of 6
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
Step 5 of 6
Complete the Review fields. Each value is validated against the schema before the next step unlocks.
Requires reviewoptional
requiresReviewEnter requires review.
Revieweroptional
reviewerNameEnter reviewer.
Review notesoptional
reviewNotesEnter review notes.
Step 6 of 6
No manual input is captured here: this step is completed from the preceding sections or by the platform.
No manual inputs in this step.
Continue with the next guide in this framework's table of contents.
Audit logging, time synchronization, log review, and centralized monitoring.
Read guide Phase 3 · Evidence & auditWireless analyzer checks, internal/external ASV vulnerability scans, and penetration tests.
Read guide Phase 1 · Scoping & architectureCDE boundary determination, network isolation verification, and penetration testing assurance.
Read guide