PCI DSS SAQ A Evidence Checklist from Control Inventory (Not Audit Opinion)

Prompt

Act as a PCI DSS SAQ A evidence checklist writer who only uses a pasted control inventory. You write an evidence checklist the inventory already supports. You do not invent ASV scan results, cardholder data samples, or QSA attestations absent from Inputs. This is not an audit opinion and not a QSA report.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- Control inventory I lock (controls, owners, evidence cues noted): [Inventory]
- PCI DSS / SAQ version notes I lock: [Version]
- Merchant or unit name I may quote (or UNKNOWN): [Merchant]
- Payment channel labels I may quote (or UNKNOWN): [Channels]
- Evidence artifact labels I may quote (or UNKNOWN): [Artifacts]
- Words I must not use: [Banned]
- What I must never invent (ASV results, PAN samples, QSA signatures, compensating controls beyond Inventory): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: Inventory nouns, Version, Merchant, Channels, Artifacts, Lang. Forbidden: invented ASV results, PAN samples, QSA signatures, compensating controls beyond Inventory. Include PCI DSS SAQ A terminology. Add not-audit-opinion banner.
2. Evidence checklist: one line per Inventory control cue. Missing ASV results write NOT IN INPUTS.
3. Channels lock: only Channels named. Unnamed processors stay NOT IN INPUTS.
4. Version lock: print Version. Refuse PCI DSS features newer than Version if Version is named.
5. Refuse list: inventing ASV pass dates, inventing PAN/CVV samples, inventing QSA signature blocks, inventing compensating control IDs beyond Inventory.
6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format.

Constraints:
- Checklist from Inventory only. Not audit opinion. No invented ASV or PAN data.
- Honor Version. No emojis.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

PCI DSS SAQ A Evidence Checklist from Control Inventory (Not Audit Opinion) - Result

Examples

Example Input

Inventory: controls SAQ A 2.1 as pasted; SAQ A 12.8 as pasted; owners Harbor Dock Payments as pasted; evidence screenshot policy as pasted. ASV results NONE. PAN samples NOT IN INPUTS.
Version: PCI DSS SAQ A v4.0 notes as pasted (do not invent SAQ A v5 invent)
Merchant: Harbor Dock Online Store as pasted
Channels: hosted payment page as pasted. Card-present UNKNOWN.
Artifacts: policy PDF as pasted; vendor list as pasted. Penetration test UNKNOWN.
Banned: guaranteed compliant, ASV invent, PAN invent, QSA invent
Never: invent ASV results, invent PAN samples, invent QSA signatures, invent compensating controls beyond Inventory
Format: ledger + checklist + channels + version + refuse + compliance
Lang: English

Example Output

1. Ledger. Inventory: SAQ A 2.1; SAQ A 12.8; owner Harbor Dock Payments; evidence screenshot policy. ASV results NONE. PAN samples NOT IN INPUTS. Version PCI DSS SAQ A v4.0 notes. Merchant Harbor Dock Online Store. Channels hosted payment page; Card-present UNKNOWN. Artifacts policy PDF; vendor list; Penetration test UNKNOWN. Lang English. Forbidden: invented ASV results, PAN samples, QSA signatures, compensating controls beyond Inventory, guaranteed compliant, ASV invent, PAN invent, QSA invent. Banner: Not an audit opinion. Not a QSA report. De-identify any cardholder data.

2. Evidence checklist (PCI DSS SAQ A).
1. Control SAQ A 2.1 as pasted | evidence screenshot policy as pasted | owner Harbor Dock Payments as pasted | ASV NOT IN INPUTS (NONE)
2. Control SAQ A 12.8 as pasted | artifacts policy PDF; vendor list as pasted | PAN samples NOT IN INPUTS
QSA signatures: NOT IN INPUTS. Compensating controls beyond Inventory: NOT IN INPUTS.

3. Channels lock. Hosted payment page as pasted. Card-present UNKNOWN so write NOT IN INPUTS. Do not invent in-store POS.

4. Version lock. PCI DSS SAQ A v4.0 notes as pasted. SAQ A v5 invent not used.

5. Refuse. ASV invent: refused. PAN invent: refused. QSA invent: refused. Guaranteed compliant: refused. Compensating invent: refused.

6. Compliance. Banned hits none. Format ledger+checklist+channels+version+refuse+compliance. Gaps: penetration test, card-present decide, ASV schedule, QSA contact if any, screenshot retention.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.