Does anyone know if there is any PCI/security related documentation for Wiremock that I can provide our legal department for approval before we use?

I am not sure that there is any for WireMock open source. You might have better luck with WireMock Cloud because that already has enterprise customers with these types of requirements ?

Ok - we'll look into that, thank you!

No worries, this should give you a good overview - https://www.wiremock.io/product