The RSI security blog site breaks down the methods in a few detail, but the method in essence goes like this: Formally attest your compliance. An AOC (attestation of compliance) is the form you use to signal you’ve accomplished PCI DSS compliance. Ending your questionnaire with no “Completely wrong” answers https://www.nathanlabsadvisory.com/penetration-testing.html