thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Attestation of Compliance (AOC)

Formal declaration of an entity's PCI DSS compliance status, accompanying a ROC or SAQ.

Definition

The AOC is signed by the entity and, where applicable, the QSA, and is provided to acquirers and customers. Service providers often share their AOC with merchants as evidence for third-party due diligence.

Example

A merchant requests its payment gateway's current AOC during vendor review.

Exam tip

For service providers, ask for the AOC and the responsibility matrix.

Related terms