Attestation of Compliance (AOC)
The short, signed statement that an organisation meets PCI DSS – the part of the assessment anyone actually reads.
The form comes from the PCI Security Standards Council, in separate versions for merchants and service providers. It summarises what environment was assessed, how, and whether each requirement is in place, not applicable or not in place. The evidence behind it is either a full Report on Compliance written by a QSA or a self-assessment questionnaire, and it is signed by both the assessor and an executive at the assessed company.
The acquirer wants one every year. It also flows downstream: PCI DSS requires you to monitor your providers' compliance, so customers of a payment gateway or cloud host ask for its AOC. A few pages of PDF have thus become a currency of their own in procurement, often requested by someone who has never seen the ROC underneath.