After submitting my answers to the SAQ questions, I was asked to provide EVIDENCE for three of the questions. Here is what they wrote: "Please share theĀ evidenceĀ ofĀ pointĀ no.Ā 4,Ā 15, 20 from the SAQ."
Here are the three questions:
ā” 04. Verify that all sensitive data is identified and classified into protection levels.
ā” 15. Verify that the application, configuration, and all dependencies can be re-deployed using automated deployment scripts, built from a documented and tested runbook in a reasonable time, or restored from backups in a timely fashion.
ā” 20. Verify that the application protects against LDAP injection vulnerabilities, or that specific security
controls to prevent LDAP injection have been implemented.
At this point, I do not know how to provide this evidence, so I'm going ask JosƩ and get this figured out. Once I figure it out, I'll post the answer below here.