How long should PCI DSS evidence be retained?

PCI DSS requires evidence retention for at least one year, with the most recent three months immediately available. Some organisations retain for longer periods to satisfy other regulatory requirements.

Can automated tools replace manual evidence collection?

Automated tools significantly reduce effort for configuration evidence, scan results, and log exports. However, some evidence types like policy documents, risk assessments, and interview records require manual preparation.

What happens if evidence is missing during a QSA assessment?

The QSA will mark the requirement as "not in place" if adequate evidence cannot be provided. The organisation must then collect the evidence and have the QSA re-validate before the ROC can be finalised.

Should evidence be collected for all systems or just a sample?

QSAs may use sampling for large environments, but the organisation should collect evidence for all in-scope systems. If the QSA finds issues in a sample, they will expand testing to the full population.

How does GRCTrack help with PCI evidence requirements?

GRCTrack provides automated evidence collection, centralised storage with requirement mapping, quality validation, expiration alerts, and cross-framework evidence reuse. This reduces evidence collection effort by up to 60%.

← PCI DSS 4.0.1 Compliance Guide

Evidence Guide

PCI DSS Evidence Requirements: What QSAs Expect

A comprehensive guide to the documentation, configurations, screenshots, logs, and interview records that QSAs require for each PCI DSS requirement family.

Understand evidence quality standards, collection best practices, and common mistakes to ensure a successful assessment.

Automate Evidence Collection View Assessment Process

PCI DSS evidence is the documentation, system configurations, screenshots, logs, and interview records that demonstrate compliance with each of the 322 requirements. QSAs evaluate evidence quality based on completeness, accuracy, date relevance, and system identification. Collecting evidence continuously — not just at assessment time — is the most effective way to ensure a successful assessment.

Types of Evidence QSAs Expect

Policies & Procedures

Written security policies, operational procedures, standards documents

System Configurations

Firewall rules, OS hardening configs, encryption settings, access controls

Screenshots & Screen Captures

Timestamped evidence of system settings, dashboard views, monitoring alerts

Log Files & Audit Trails

Authentication logs, access logs, change management records, security event logs

Interview Records

QSA notes from personnel interviews confirming awareness and adherence to procedures

Test Results

Vulnerability scan reports, penetration test results, ASV scan outputs, segmentation test evidence

Evidence by PCI DSS Requirement Family

Each of the 12 PCI DSS requirement families requires specific types of evidence. The following table summarises the key evidence types and documents QSAs expect for each requirement.

Requirement	Evidence Types	Key Documents
Req 1 — Network Security	Configurations, Diagrams, Logs	Firewall configs, network diagrams, rule review records
Req 2 — Secure Configuration	Configurations, Standards, Logs	Hardening standards, configuration baselines, default credential removal
Req 3 — Data Protection	Configurations, Policies, Procedures	Encryption configs, key management procedures, data retention policies
Req 4 — Transmission Encryption	Configurations, Certificates	TLS configurations, certificate inventories, protocol versions
Req 5 — Malware Protection	Configurations, Logs, Screenshots	AV configs, scan logs, update records
Req 6 — Secure Development	Procedures, Logs, Test Results	SDLC documentation, code review records, change control logs
Req 7 — Access Restriction	Configurations, Matrices, Logs	Access control matrices, role definitions, access review records
Req 8 — User Identification	Configurations, Screenshots, Policies	Authentication configs, MFA settings, password policy configs
Req 9 — Physical Security	Logs, Photos, Certificates	Visitor logs, camera footage, media destruction certificates
Req 10 — Logging & Monitoring	Configurations, Logs, Screenshots	Log configs, SIEM alerts, daily log review evidence
Req 11 — Security Testing	Test Results, Configurations, Reports	ASV scan reports, pen test reports, IDS/IPS configs, segmentation test results
Req 12 — Security Policies	Policies, Assessments, Records	Information security policy, risk assessments, training records, incident response plans

Evidence Quality Standards

QSAs evaluate evidence against four key quality criteria. Evidence that fails to meet these standards will be rejected and must be re-collected.

Date stamps

All evidence must show when it was collected. Undated evidence is rejected.

System identification

Screenshots must show hostname/IP/system name to identify which system is shown.

Completeness

Evidence must cover the full scope — partial evidence for a subset of systems is insufficient.

Relevance

Evidence must be from the current assessment period, not prior years.

Evidence Collection Best Practices

1Automate evidence collection where possible (scheduled config exports, automated screenshots)

2Use a centralised evidence repository with version control

3Establish naming conventions (e.g., REQ-03.4_encryption-config_2026-02-15.pdf)

4Collect evidence continuously, not just before assessment

5Assign evidence owners for each requirement family

6Conduct internal evidence reviews quarterly to identify gaps before the QSA does

Common Evidence Mistakes

Collecting evidence only at assessment time (leads to rushed, incomplete evidence and failed requirements)

Screenshots without date stamps or system identification

Providing policies that don't match actual system configurations

Missing evidence for a subset of in-scope systems (must cover ALL systems)

How GRCTrack Streamlines Evidence Management

Automated evidence collection with scheduled configuration snapshots

Centralised evidence repository with automatic requirement mapping

Evidence quality validation checking for date stamps, system ID, completeness

Evidence expiration alerts when documents approach their renewal date

Cross-framework evidence mapping — one document satisfies multiple framework requirements

Related PCI DSS Resources

PCI DSS 4.0.1 Guide ROC Checklist Assessment Process QSA Assessment Guide Scope Determination Compensating Controls

PCI DSS Evidence Requirements — Frequently Asked Questions

Automate Your PCI Evidence Collection

Streamline evidence collection, ensure quality standards, and maintain continuous compliance readiness with a centralised evidence management platform.

Start Free Trial Contact Sales