When Merchants sign a agreement with a payment processor, they agree to be subject to fines should they fall short to take care of PCI DSS compliance. Formally attest your compliance. An AOC (attestation of compliance) is the form you employ to sign that you simply’ve accomplished PCI DSS compliance. https://www.nathanlabsadvisory.com/blog/nathan/understanding-the-sama-cybersecurity-framework-requirements-and-implementation/