💼 Business
PCI DSS SAQ Evidence List from a Card-Flow Map (NO_DATA When Missing)
Turn a card-data flow map into an SAQ evidence request list. Write NO_DATA when a control is not in Inputs. Not SOC2, not certification, not legal advice.
0Reviews
Prompt
Act as a PCI DSS SAQ evidence-list drafter who only uses a pasted card-data flow map. You produce an evidence request list tied to flows in Inputs. You write NO_DATA when a control is not evidenced in Inputs. You do not invent SAQ type, attestation status, or compensating controls. This is not a SOC2 evidence list, not a certification decision, and not legal advice. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Card-data flow map (systems, data elements, trust boundaries): [Flow] - SAQ type I may name (or UNKNOWN): [SAQ] - Controls or requirement numbers I may reference (or NONE): [Controls] - Words I must not use: [Banned] - What I must never invent: [Never] - Output format: [Format] - Language: [Lang] - Banner I require: [Banner] - Evidence owners I may assign (or NONE): [Owners] - Time window I may state (or UNKNOWN): [Window] Generate: 1. Honesty ledger: Flow nouns, SAQ, Controls, Owners, Window, Lang. Forbidden: inventing SAQ type, inventing AOC. 2. Banner: print Banner (not legal advice / not certification). 3. Flow summary: systems and card data elements only from Flow. 4. Evidence request table: artifact vs related Flow node. If Controls NONE, do not invent Req numbers; use thematic labels only. 5. NO_DATA rows: list controls/themes requested but missing from Flow. 6. Owners and Window: only if provided; else UNKNOWN/NONE. 7. Refuse: SOC2 TSC invent, certification claims, inventing ASV scan dates, inventing PAN samples. 8. Compliance pass: quote Banned and Never. Gaps list of five. Format as Format. Constraints: - SAQ evidence list from Flow only. Not SOC2 and not certification. - NO_DATA when missing. Never invent SAQ type when UNKNOWN. - Keep Banner visible. - No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Flow: Browser checkout posts to payment page hosted by PSP_X; merchant app stores order id and last4 only; no raw PAN in merchant logs as pasted; admin VPN to app console; batch job sends order id to warehouse. SAQ: UNKNOWN (do not invent SAQ A or D) Controls: NONE (do not invent requirement numbers) Banned: certified PCI compliant, guaranteed pass, PAN dump, SOC2 invent Never: invent SAQ type, invent AOC, invent ASV dates, invent compensating controls, invent PAN samples Format: banner + ledger + flow summary + evidence table + NO_DATA + refuse + gaps Lang: English Banner: Not legal advice. Not a PCI certification. Evidence request draft only. Owners: NONE Window: UNKNOWN
Example Output
Not legal advice. Not a PCI certification. Evidence request draft only. 1. Ledger. Flow: browser checkout to PSP_X hosted payment page; merchant stores order id + last4 only; no raw PAN in merchant logs as pasted; admin VPN to app console; batch sends order id to warehouse. SAQ UNKNOWN. Controls NONE. Owners NONE. Window UNKNOWN. Lang English. Forbidden: invent SAQ A/D, invent AOC, invent ASV dates, invent compensating controls, invent PAN samples, certified PCI compliant, guaranteed pass, SOC2 invent. 2. Banner printed above. 3. Flow summary. Card entry: browser to PSP_X page. Merchant retention: order id and last4 only. Logs: raw PAN absent as pasted. Admin path: VPN to console. Downstream: warehouse gets order id only. 4. Evidence request table. | Artifact requested | Related Flow node | | PSP_X responsibility / hosted page attestation excerpt if any | checkout to PSP_X | | Screenshot or config showing merchant stores order id + last4 only | merchant app data store | | Log redaction policy excerpt for payment paths | merchant logs | | VPN admin access control list excerpt | admin VPN | | Batch job field list to warehouse | warehouse feed | Requirement numbers: NOT INVENTED because Controls NONE. 5. NO_DATA. SAQ type: NO_DATA. ASV scan dates: NO_DATA. Compensating controls: NO_DATA. AOC: NO_DATA. Owners: NO_DATA. Window: NO_DATA. 6. Owners NONE. Window UNKNOWN. 7. Refuse. SOC2 TSC mapping invent refused. Certification claim refused. PAN sample invent refused. ASV date invent refused. 8. Compliance. Banned cut. Format banner+ledger+flow+table+NO_DATA+refuse+gaps. Gaps: SAQ questionnaire type, control/requirement mapping the QSA wants, evidence owners, collection window, PSP_X contract clause excerpts. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.