It depends on your transaction volume, your merchant or service provider level, and how card data moves through your environment. Your acquirer sets the obligation; a short call confirms which path applies before you commit to anything.

An understanding of how you take payments, network and data-flow documentation if you have it, and a point of contact who can pull evidence together. If that documentation does not exist yet, producing it is part of the scoping phase.

Nothing is signed until it is met. We identify the gap, explain what the Standard is asking for, and work with your team on a control that satisfies it. Remediation before attestation is normal, not a failure.