PCI-sensitive entities require testers to attach supporting files when completing control tests. What should be configured?
Select an answer to reveal the explanation.
Short Explanation
If it is cardholder data territory, “trust me” is not evidence. Require attachments on those control tests for PCI-sensitive entities. Optional-everywhere, no-attachments, or evidence-only-when-green will not satisfy a QSA.
Full Explanation
Evidence requirements on control tests ensure supporting artifacts are captured when tests complete for high-sensitivity scopes. Configuring mandatory evidence attachments for PCI-sensitive entities strengthens examiner-ready packages. Making evidence optional, blocking attachments, or collecting evidence only on passes undermines consistent proof for payment-card control testing.