SAQ selection + evidence collection plan
Scenario
Based on your scoping (Day 10), SwiftLend qualifies for SAQ A-EP (some page controls exist, PAN not stored server-side). The QSA now wants your evidence collection plan for the SAQ.
Your role
You are producing the evidence plan.
Your task
Produce an evidence collection plan: 1. Which specific SAQ A-EP questions apply to SwiftLend (~140 total) 2. Evidence type per question (screenshot / policy / log extract / attestation) 3. Owner + due date per evidence item (assume assessment in 60 days) 4. Evidence storage + versioning strategy 5. QSA walkthrough plan (which SMEs, which sessions)
Deliverable format: Plan document ~600-1000 words + evidence table
Toolkit
- SAQ A-EP has ~140 questions vs SAQ D which has ~330
- Common evidence types: policies (Word/PDF), procedures, screenshots dated + system-visible, log samples, training records, scan results
- QSA walkthrough: usually 3-5 days on-site (or virtual), with SME sessions per requirement
- Evidence versioning: NEVER overwrite — always date-stamp new versions
Success criteria (what the AI grades against)
- Evidence types matched to question types (policy question ≠ log extract answer)
- Owner assignment realistic — CISO can't own 140 items
- Timeline builds in review + sign-off buffer
- Storage strategy addresses confidentiality (evidence isn't emailed around)
- QSA walkthrough plan groups questions by requirement (efficient use of QSA time)
Log in to submit your deliverable for AI review.
Log in / Register