ROC Report Export

Kliper builds a fully formatted Report on Compliance (ROC) directly from your assessment data — as a print-ready PDF or an editable DOCX (based on the official PCI DSS v4.0.1 ROC template, Revision 3). The export runs through a guided modal where you pick deliverables and format, see a completion check, and every export is archived automatically in the ROC Library. You can also import an existing ROC to pre-fill an assessment.

Prerequisites

Before generating the ROC, ensure the following are complete:

Generating the Report

Open your assessment, then use the Actions → Export menu to open the export modal.

Importing an existing ROC

Already have a ROC from a prior period? Import it to pre-fill the assessment instead of re-keying everything.

ROC Library

Every ROC you export is captured as an immutable version in the ROC Library — the full history per engagement, from first draft to signed final. Open it from ROC Library in the sidebar.

Browse by assessment or by client. Each version shows:

• Filename, version number (v1, v2, …) with a Latest badge
• Final or Draft · X% status (green at 100%, amber while in progress)
• Format, file size, page count (PDF), who exported it and when, and which deliverables it contains
• Preview (PDF only) and Download

Tracking completion

The assessment sidebar shows live progress so you know what’s left before exporting:

• Status dots on each section/subsection — green when complete, amber when partial, gray when empty
• Per-subsection counters (e.g. 3.1 → 2/4) and per-requirement spec counts (e.g. Req 1 → 8/12 specs)
• Group headers roll up — Executive Summary as a percentage, Requirements and Appendices as completed/total

What counts as one completion unit: each setup field is one; a table is one unit (done only when it has at least one complete row); a checkbox group is one answer; and each requirement spec is one (decided once it has a finding). Progress refreshes automatically a moment after you save.

Assessment Summary Report (PDF)

For a quick status snapshot — without generating the full ROC — export a branded Summary Report straight from the assessment. Open the assessment and, on the Progress Status card, click Summary PDF.

It’s a one- to two-page branded PDF covering:

• Progress and compliance — drafting completion (requirements decided) and compliance level (requirements In Place), reported as two distinct numbers so a partly-drafted assessment reads honestly rather than looking finished.
• Requirement status — the In Place / Not in Place / In Progress / Not Applicable / Not Started breakdown, per PCI requirement.
• Milestones — completion against the PCI DSS prioritized-approach milestones.
• Backlog — the open tasks tied to the assessment.

Use it to keep a client or engagement manager current between formal ROC exports. The numbers match the assessment Overview exactly (same risk-model source), and the report reflects the moment you export it.

Data exports

Beyond the ROC itself, the Reports page (/reports) generates supporting data exports through the Generate report modal:

Each exports as a styled Excel (.xlsx) — dark header row, status-coloured cells, filter dropdowns, and auto-sized columns — or CSV (UTF-8 with a BOM, so it opens cleanly in Excel and Google Sheets).

How the Export Works

The DOCX export engine processes the ROC template through a multi-step pipeline:

Step 1 — Template Loading

The engine loads a Word document template from the templates/ directory. The default template is report.docx, based on the PCI SSC’s official ROC template (Revision 3). Custom templates can be used by specifying a template name.

The template is a standard .docx file (ZIP archive containing XML). Tags are placed inline in the Word document as {{Tag-Name}} placeholders.

Step 2 — XML Run Merging

Word frequently splits text across multiple XML <w:r> (run) elements due to spell-check markers, formatting changes, and language attributes. This means a tag like {{Client-Name}} may be split across 3 or more XML elements.

The engine merges adjacent runs within each paragraph so that {{ ... }} tags appear in a single <w:t> element. This ensures reliable tag detection and replacement.

Step 3 — Loop Processing (Table Row Cloning)

For repeating data (tables with multiple rows), the template uses loop tags:

{{#LoopName}}
  {{.fieldA}}  |  {{.fieldB}}  |  {{.fieldC}}
{{/LoopName}}

The engine:

1. Identifies the <w:tr> (table row) elements that contain the loop open and close tags.
2. Treats the enclosed row(s) as a template.
3. Clones the template row once per item in the data array.
4. Replaces {{.fieldName}} with each item’s field values.
5. Renders boolean fields as checkbox symbols: true → ☒, false → ☐.

Supported loop data sources:

Step 4 — Diagram Image Insertion

For Sections 4.1 (Network Diagrams) and 4.2 (Account Data Flow Diagrams), the engine:

1. Queries uploaded image files tagged to these sections.
2. Embeds the images directly into the Word document at the {{diagrams-4.1}} and {{diagrams-4.2}} tag locations.
3. Creates the necessary Word XML relationships for inline image rendering.

Step 5 — Tag Replacement

All remaining {{Tag-Name}} placeholders are replaced with assessment data. The engine maintains a comprehensive tag map covering every section of the ROC:

Step 6 — Checkbox Resolution

The template uses checkbox tags for selection fields (radio buttons in the assessment UI):

{{check-onsite}}     → ☒ (if selected) or ☐ (if not)
{{check-combination}} → ☒ or ☐
{{check-remote}}      → ☒ or ☐

Checkbox tags cover: remote testing method, QSA consultation, subcontractor usage, assessment completion type, and overall compliance result.

Step 7 — Output Generation

The processed document is compressed using DEFLATE and returned as a buffer. The file is named using the pattern {client-slug}-roc-{date}.docx and streamed to the user’s browser for download.

Custom Templates

Organizations can use custom Word templates by placing .docx files in the templates/ directory. Custom templates must use the same {{Tag-Name}} convention. If a requested template is not found, the engine falls back to the default report.docx.

Troubleshooting