Home/Solutions/Sample documents See what you will receive. Every engagement ends with documents you can hand to your bank, your clients, your auditors or a regulator. Click any document to see what it contains, how long it stays valid and how often it should be produced.Request a redacted sampleBack to solutions Reports, certificates and registers. Card paymentsClient assuranceSecurity testingPrivacy and governanceRemediationCard paymentsKerson WallawRapport de conformité (ROC)SampleRapport de conformité (ROC)Ubitrak (Qualified Security Assessor)Report on Compliance (ROC)SampleExecutive summaryScope and description of the cardholder data environmentNetwork and data-flow diagramsTesting procedures and results for each of the 12 requirementsCompensating and customized controlsUbitrak (Qualified Security Assessor)Report on Compliance (ROC)Every year, and whenever scope changes significantlyKerson WallawAttestation de conformité (AOC)SampleAttestation de conformité (AOC)Your organization, signed with the QSA when a ROC appliesAttestation of Compliance (AOC)SampleOrganization and assessor contact detailsSummary of scope and payment channelsValidation type (ROC or SAQ)Compliance statusSignatures of an executive officer and, where applicable, the QSAYour organization, signed with the QSA when a ROC appliesAttestation of Compliance (AOC)Every year, with each ROC or SAQKerson WallawQuestionnaire d’auto-évaluation (SAQ)SampleQuestionnaire d’auto-évaluation (SAQ)Your organization, guided by Accel PCISelf-Assessment Questionnaire (SAQ)SampleEligibility criteria for the SAQ typeDescription of your business and payment channelsRequirement-by-requirement responsesCompensating controls worksheet, if anyAttestation sectionYour organization, guided by Accel PCISelf-Assessment Questionnaire (SAQ)Every year, and when your payment channels changeAn Approved Scanning Vendor (ASV)ASV external scan reportSampleScan customer and ASV attestationsExecutive summary with pass or fail statusVulnerabilities by severityDisputes, exceptions and false positivesRescan evidence after fixesAn Approved Scanning Vendor (ASV)ASV external scan reportEvery quarter, and after significant changes to internet-facing systemsKerson WallawRapport de scan externe ASVSampleRapport de scan externe ASVAccel PCI portalAccel PCI compliance certificateSampleMerchant name and locationsSAQ type completedDate of completionValidity periodVerification referenceAccel PCI portalAccel PCI compliance certificateEvery year, at renewalKerson WallawCertificat de conformité PCI d’AccelSampleCertificat de conformité PCI d’AccelKerson WallawAvis de rappel de renouvellementSampleAvis de rappel de renouvellementAccel PCI portalRenewal reminder noticeSampleItems about to expireDue datesTasks to start nowLink back to the portalAccel PCI portalRenewal reminder noticeBefore each yearly renewal and each quarterly scanClient assuranceKerson WallawCertificat ISO/IEC 27001SampleCertificat ISO/IEC 27001An accredited certification bodyISO/IEC 27001 certificateSampleCertified organization and sitesScope of the management systemStandard and edition (ISO/IEC 27001:2022)Reference to the Statement of ApplicabilityValidity dates and accreditation markAn accredited certification bodyISO/IEC 27001 certificateRecertification every 3 years; surveillance audit every yearKerson WallawRapport SOC 2 de type IISampleRapport SOC 2 de type IIA partner CPA firmSOC 2 Type II reportSampleIndependent service auditor’s report (opinion)Management’s assertionDescription of the systemCriteria, controls and tests of operating effectivenessExceptions and management responsesA partner CPA firmSOC 2 Type II reportEvery yearKerson WallawPack de réponses aux questionnaires de sécuritéSamplePack de réponses aux questionnaires de sécuritéYour organization, prepared with UbitrakSecurity questionnaire response packSampleCompleted questionnaire in the client’s formatEvidence indexPolicy excerptsCertificates and reports referencedSecurity contactsYour organization, prepared with UbitrakSecurity questionnaire response packOn request, from a master set reviewed every yearKerson WallawEnsemble de politiques de sécurité de l’informationSampleEnsemble de politiques de sécurité de l’informationYour organization, built from Accel GRC templatesInformation security policy setSampleInformation security policyAcceptable useAccess controlIncident responseVendor managementYour organization, built from Accel GRC templatesInformation security policy setEvery year, and after significant changesSecurity testingUbitrakPenetration test reportSampleExecutive summaryScope and methodologyFindings ranked by risk, with evidenceRemediation guidanceRetest resultsUbitrakPenetration test reportEvery year, and after significant infrastructure or application changesKerson WallawRapport de test d’intrusionSampleRapport de test d’intrusionKerson WallawRapport de test de segmentationSampleRapport de test de segmentationUbitrakSegmentation test reportSampleSegmentation controls in scopeTest method from each segmentResultsRecommendationsUbitrakSegmentation test reportEvery year for merchants, every six months for service providers, and after changes to segmentationKerson WallawLettre de nouveau testSampleLettre de nouveau testUbitrakRetest letterSampleOriginal findingsRetest date and methodStatus of each findingTester confirmationUbitrakRetest letterAfter each remediation cyclePrivacy and governanceKerson WallawGouvernance de la confidentialité et politique de confidentialitéSampleGouvernance de la confidentialité et politique de confidentialitéYour organization, built in Accel GRCPrivacy governance and privacy policySampleRoles and responsibilitiesPerson in charge and contact detailsRetention and destruction rulesComplaint processConfidentiality incident processYour organization, built in Accel GRCPrivacy governance and privacy policyPublish once, review every year and whenever your practices changeYour organization, kept in Accel GRCConfidentiality incident registerSampleDescription of each incidentDate or period of the incident and when you became aware of itPersonal information concerned and number of people affectedRisk of serious injury assessmentNotices sent to the CAI and individualsYour organization, kept in Accel GRCConfidentiality incident registerUpdated every time an incident occurs; reviewed regularlyKerson WallawRegistre des incidents de confidentialitéSampleRegistre des incidents de confidentialitéKerson WallawAnalyse d’impact sur la vie privée (PIA)SampleAnalyse d’impact sur la vie privée (PIA)Your organization, with Accel GRCPrivacy impact assessment (PIA)SampleProject descriptionPersonal information involvedData flows and transfersRisks to individualsMitigation measuresYour organization, with Accel GRCPrivacy impact assessment (PIA)Before each project involving personal information, and before each transfer outside QuebecAccel GRCInternal audit reportSampleScope and criteriaControls reviewedFindings and ratingsRecommendationsManagement responsesAccel GRCInternal audit reportEvery yearKerson WallawRapport d’audit interneSampleRapport d’audit interneKerson WallawDossiers de formationSampleDossiers de formationAccel GRCTraining recordsSampleEmployees trainedCourse and versionCompletion datesPolicy acknowledgementsAccel GRCTraining recordsAt hiring and every yearRemediationKerson WallawPlan de remédiationSamplePlan de remédiationKW Consulting, with UbitrakRemediation planSampleFindings with risk rankingOwners and target datesBudget estimateDependenciesStatus trackingKW Consulting, with UbitrakRemediation planUpdated weekly during remediation, rebuilt after each assessmentKW ConsultingClosed findings evidence packSampleFinding referenceChange madeEvidence: configurations, screenshots, logsDate and approverAssessor acceptanceKW ConsultingClosed findings evidence packAt each remediation cycleKerson WallawDossier de preuves des constats clôturésSampleDossier de preuves des constats clôturésKerson WallawDiagrammes de réseau et de flux de donnéesSampleDiagrammes de réseau et de flux de donnéesKW ConsultingNetwork and data-flow diagramsSampleNetwork diagram with security zonesCardholder or personal data flowsSystem inventoryConnections to third partiesKW ConsultingNetwork and data-flow diagramsEvery year, and after any change to the network or data flowsKerson WallawDocumentation de passation et d’exploitationSampleDocumentation de passation et d’exploitationKW ConsultingHandover and runbook documentationSampleArchitecture summaryOperating proceduresMonitoring and alertsContacts and escalationTraining notesKW ConsultingHandover and runbook documentationAt the end of each project