Evidence export
Export a ZIP holding a PDF report and two complete CSVs. What is in each file, what is truncated in the PDF, and what is not.
Last update:
PCI DSS > Overview > Export evidence pack produces a ZIP holding your payment-page scope, your script inventory, and the full history of decisions.
Available to Viewer and above, so a compliance lead who cannot change anything can still pull evidence.
ZIP contents
The archive holds three files:
| File | Contents |
|---|---|
pci-dss-report.pdf | A formatted report in 10 sections, with a reference number and generation timestamp |
script-inventory.csv | Every inventory row, including retired scripts, 21 columns |
change-ledger.csv | Every ledger event, all time, untruncated |
The PDF carries these sections:
- Summary
- Payment pages in scope
- How the evidence is collected
- Authorized scripts
- Scripts pending review
- Rejected scripts
- Retired scripts
- Justification rules
- Script origins
- The change ledger
The report states that it addresses PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1. It is evidence you present, not a certification.
Truncation limits
This is the part to understand before handing the PDF to anyone.
The PDF is a summary. Each section lists at most 300 rows, with a note saying how many were omitted. The ledger section covers the last 12 months and prints the 200 most recent entries, though its totals are computed over the whole 12 months.
The CSVs are complete. No row limit, no date window. If your assessor wants the full trail, the CSVs are the artefact, and the PDF is the readable overview.
Say this explicitly when you hand it over. An assessor who reads "showing the first 300" in a PDF and is not told the CSV is complete may reasonably ask for something you already gave them.
When to export
Export once early, before anyone asks, so you know what it looks like and can fix gaps while there is time. Empty justifications and a low review coverage are much cheaper to address before an audit window than during one.
Then export at the point you want to freeze: end of an assessment period, or a date your assessor names. The pack is a snapshot for everything except the ledger, so the date you generate it matters.
Before you export
Three things worth checking:
- Review coverage: Anything short of complete means scripts with no decision. See the overview.
- Justification quality: Sort through the inventory CSV and look for one-word justifications. They will not survive review.
- Scope accuracy: Confirm your payment-page patterns still match your real checkout URLs after any redesign. For more information, refer to Payment pages.
Next steps
Tags
Reusable labels for classifying scripts, applied by hand or automatically by justification rules. Per-website, and deleting one changes nothing else.
Script inventory
Every script observed on your payment pages, with a review status. The four tabs, what each status means, and how a script leaves the list.