Frequently Asked Questions

< Back to search page

Can the AOC be redacted to protect sensitive information?

FAQ Response

It is permissible for an entity to redact sensitive data from their Attestation of Compliance (AOC) when providing it to a business partner or customer. The level of detail provided to business partners and customers may be less than that required for compliance reporting (that is, to a payment brand or acquirer as part of an entity’s PCI DSS validation).  For example, it may not be necessary for business partners or customers to know the city where a data center is located, or the details about applications and technologies that are present in the CDE.  Where such information is considered sensitive or confidential, and the entity is sharing the AOC with a business partner or customer that does not need that level of information, it is permitted for the information to be redacted.

Examples of AOC sections that might contain information considered to be sensitive include:
  • Part 2c. Locations: Information in the “Location(s) of facility” column
  • Part 2d. Payment Applications: Details of Payment Application Name, Version Number, and Application Vendor
  • Part 2e. Description of Environment
For many entities, sharing the AOC with business partners and customers may be preferred to sharing the full ROC. However, for the AOC to have value for this purpose, the information contained within must provide a meaningful summary of the assessed environment in order to provide partners/customers with assurance that the AOC actually represents the environment it is expected to. Entities should have a clear understanding and agreement with their business partners and customers about the information to be shared for the purposes of evidencing their compliance status.

Note: It is not permitted to redact any content from the signed AOC prior to submitting to a payment brand or acquirer for compliance validation purposes.

See also FAQ #1220: Are compliance certificates recognized for PCI DSS validation?

September 2015
Article Number 1354

Related Articles

What date should be used for “Date of Report” in the ROC?

What is an Attestation of Compliance?

Can an Attestation of Compliance (AOC) be provided to an assessed entity before the Report on Compliance (ROC) is finalized?

Which service provider category should I use for Part 2 of the PCI DSS Attestation of Compliance (AOC) for Service Providers?

What is meant by a “payment application” in Part 2d of the Attestation of Compliance?