PCI Compliance App — How to Use

Click-by-click instructions for setup, daily use, training, and reporting.

First-Time Admin Setup

1. Sign in with your CUB Google account using the Sign in with Google button.
2. Once on the Dashboard, click Admin in the left sidebar.
3. Under Database Setup, click Seed Controls from JSON to import all 237 PCI DSS v4.0.1 controls.
4. Under Compliance Cycles, click + New Cycle and fill in: cycle name, SAQ type, start and end dates.
5. Under User Management, set roles for each team member (compliance_officer, trainee, or viewer).
6. Share the app URL with your team — access is gated by Google SSO.

Daily Operator Workflow

1. Sign in and go to the Dashboard to see your current compliance score and any open items.
2. Click Control Library in the sidebar to browse all 12 PCI requirements.
3. Filter by requirement number or status, then click any control row to open it.
4. Update the status (In Place / Partially In Place / Not In Place / Not Applicable).
5. Add a note explaining your assessment, then attach supporting evidence files if needed.
6. Click Save — the change is logged to the audit history automatically.

Running Training Attestation

1. Click Training in the sidebar.
2. Click Start on any available training module.
3. Complete the module content, then click Attest Completion.
4. Your completion is recorded and visible to admins in the audit log.

Exporting a QSA Report

1. Click Reports in the sidebar.
2. Select the compliance cycle you want to export.
3. Click Export JSON Manifest for a machine-readable summary, or QSA Export for a formatted assessor report.

Understanding Control Statuses

• In Place — Control is fully implemented and evidenced.
• Partially In Place — Work in progress; note required.
• Not In Place — Gap identified; remediation needed.
• Not Applicable — Control does not apply to your SAQ scope.
• Compensating Control — Alternative control documented and approved.