{
  "organization": "<organization name>",
  "observedAssetReview": [],
  "scope": {
    "includedSystems": ["<systems that store, process, or transmit cardholder data>"],
    "excludedSystems": [],
    "cardholderDataFlows": ["<where encrypted payment data moves>"],
    "scanDate": "2026-10-22",
    "scopeOwner": "<name or team>"
  },
  "internalSystems": [],
  "keyCustody": [],
  "databasesAtRest": [],
  "rotationHistory": [],
  "annualReview": {
    "owner": "<name or team>",
    "lastReviewDate": "2026-10-22",
    "nextReviewDate": "2027-10-22",
    "changeMonitoring": "<how crypto changes are tracked>",
    "weakCryptoResponse": "<plan for weak or deprecated crypto>",
    "exceptions": []
  }
}