📁 Other
PCI DSS SAQ Scope Checklist from System Inventory (Not Certification)
Build a PCI DSS SAQ scope checklist from a system inventory only. Not certification. No invented cardholder data flows, PAN samples, or auditor opinions beyond the inventory.
0Reviews
Prompt
Act as a PCI DSS scoping documentation aide who only uses a pasted system inventory. You write an SAQ scope checklist the inventory already supports. You do not invent cardholder data flows, PAN samples, SAQ type guarantees, or QSA opinions. This is not certification and not a security assessment opinion. Add a one-line banner: not certification advice; de-identify any cardholder data. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - System inventory I lock (system labels, data stubs, network notes): [Inventory] - PCI DSS / SAQ version notes I lock: [Version] - Merchant label I may quote (or UNKNOWN): [Merchant] - Required SAQ sections I may quote (or UNKNOWN): [Sections] - Words I must not use: [Banned] - What I must never invent (PAN samples, CHD flows, SAQ guarantees, QSA opinions): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Inventory nouns, Version, Merchant, Sections, Lang. Forbidden: invented PAN samples, CHD flows, SAQ guarantees, QSA opinions. Banner: not certification advice; de-identify; not a security assessment opinion. 2. SAQ scope checklist table: one row per Inventory system or data stub. Missing network notes write NOT IN INPUTS. 3. Section set: only Sections listed. Unnamed sections stay NOT IN INPUTS. Never print PAN samples or invented CHD flows. 4. Version lock: print Version. Refuse PCI objects newer than Version if Version is named. 5. Refuse list: inventing PAN samples, inventing CHD flows, inventing SAQ guarantees, inventing QSA opinions. 6. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - Checklist from Inventory only. No invented CHD VALUES. Not certification. - Honor Version. No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Generated Output
This image was generated using the prompt above.
Examples
Example Input
Inventory: system Harbor Quay POS as pasted data stub tokenized pan as pasted network note segmented VLAN as pasted; system River Ops E-commerce as pasted data stub payment page as pasted. PAN sample NOT IN INPUTS. QSA opinion NONE. Version: PCI DSS 4.0 / SAQ A as pasted (do not invent SAQ A-EP fields without inventory) Merchant: Harbor Quay Retail as pasted Sections: Network segmentation as pasted; Payment page as pasted. Key management UNKNOWN. Banned: guaranteed compliant, PAN invent, CHD invent, QSA invent Never: invent PAN samples, invent CHD flows, invent SAQ guarantees, invent QSA opinions Format: ledger + table + sections + version + refuse + compliance Lang: English
Example Output
1. Ledger. Inventory: system Harbor Quay POS data stub tokenized pan network note segmented VLAN; system River Ops E-commerce data stub payment page. PAN sample NOT IN INPUTS. QSA opinion NONE. Version PCI DSS 4.0 / SAQ A. Merchant Harbor Quay Retail. Sections Network segmentation; Payment page; Key management UNKNOWN. Lang English. Banner: not certification advice; de-identify; not a security assessment opinion. Forbidden: invented PAN samples, CHD flows, SAQ guarantees, QSA opinions, guaranteed compliant, PAN invent, CHD invent, QSA invent. 2. SAQ scope checklist. 1. Harbor Quay POS | data tokenized pan as pasted | network segmented VLAN as pasted | PAN sample NOT IN INPUTS | QSA NONE. 2. River Ops E-commerce | data payment page as pasted | network NOT IN INPUTS | PAN sample NOT IN INPUTS | QSA NONE. CHD flows beyond inventory not invented. PAN samples not printed. 3. Section set. Network segmentation; Payment page as Sections. Key management UNKNOWN so write Key management NOT IN INPUTS. No CHD VALUES printed. No third section invented. 4. Version lock. PCI DSS 4.0 / SAQ A as pasted. SAQ A-EP fields not used without inventory. Compensating control form NOT IN INPUTS. 5. Refuse. PAN invent: refused. CHD invent: refused. SAQ guarantee invent: refused. QSA invent: refused. Guaranteed compliant: refused. 6. Compliance. Banned hits none. Format ledger+table+sections+version+refuse+compliance. Gaps: network for River Ops E-commerce, Key management decision, SAQ type confirmation, compensating controls, ASV scan path. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.