A city payments team faces PCI obligations and asks which IRM outcome should define success for phase one. Which criteria are most appropriate?

For a city payments team facing PCI obligations, phase-one success should be scoped entities, mapped citations or control objectives, and repeatable control tests—not only a slide deck. If the platform cannot show scoped testing for payment-relevant systems, the IRM outcome has not landed regardless of how polished the briefing looks. Presentation materials may communicate status to council or executives, but they are not the definition of done for compliance-driven IRM. Boring, repeatable evidence in the instance is the win. A finished executive PowerPoint with no entities or control tests in the instance fails that definition. Complete CIS-SIR playbook coverage for every payment outage scenario measures incident readiness, not PCI control testing in IRM. Demanding 100 percent CAD unit-test coverage of custom GRC Script Includes before any attestation prioritizes custom code metrics over configured compliance evidence. Exam caveat: compliance phase-one done means scoped entities plus mapped obligations plus repeatable tests. Operational check for payments: publish a phase-one exit checklist requiring named PCI entities, mapped citations or objectives, at least one completed test cycle per critical control, and issues tracked in IRM—slides optional, platform evidence mandatory.