PCI-sensitive entities require testers to attach supporting files when completing control tests. What should be configured?
Select an answer to reveal the explanation.
Short Explanation
If it is cardholder data territory, “trust me” is not evidence. Require attachments on those control tests for PCI-sensitive entities. Optional-everywhere, no-attachments, or evidence-only-when-green will not satisfy a QSA.
Full Explanation
Evidence requirements on control tests ensure supporting artifacts are captured when testers complete work for high-sensitivity scopes. For PCI-sensitive civic or payment entities, configuring mandatory evidence attachments on control tests strengthens examiner-ready packages for cardholder-data control testing. Making evidence optional everywhere and relying on tester memory during interviews fails by concept because memory is not durable evidence and PCI-oriented reviews expect artifacts. Blocking all file attachments platform-wide to reduce storage costs fails by concept because storage optimization cannot erase the need for proof on payment-sensitive controls. Requiring evidence only on passed tests and never on failed tests fails by concept because failed tests especially need artifacts that justify the fail and support remediation and retest. Exam caveat: CIS-RC and payment-card readiness treat evidence capture as a configured control-test requirement for sensitive entities, not an optional courtesy. Operational check: enable required evidence attachments for PCI-sensitive entity control tests, attempt to close a test without a file, and confirm the platform blocks completion until an attachment is present.