pci-dss-compliance – Data & Science skill for AI agents

PCI DSS Compliance

Implement PCI DSS v4.0.1 control planning for protecting cardholder data across the Cardholder Data Environment (CDE), including network segmentation, encryption, access controls, and ongoing testing.

When to Use

• Processing, storing, or transmitting payment card data
• Scoping the Cardholder Data Environment for PCI assessment
• Selecting the appropriate Self-Assessment Questionnaire (SAQ)
• Implementing network segmentation to reduce CDE scope
• Preparing for QSA assessment or ASV scanning

Assessment boundaries

Use the current PCI SSC standard and SAQ documents, not this abbreviated checklist,

for exact wording/applicability and testing frequencies. Confirm SAQ eligibility

with the entity accepting it; question counts and hosted redirects alone do not

select an SAQ. Embedded payment forms have additional script-attack eligibility

criteria; [PCI SSC FAQ 1588](https://www.pcisecuritystandards.org/faqs/1588/)

explains the distinction. The [v4.0.1 bulletin](https://www.pcisecuritystandards.org/wp-content/uploads/2024/10/SAQs_for_PCI_DSS_v4.0.1_Bulletin.pdf)

links the authoritative selection process. Never copy real PAN, CVV or keys into

prompts, logs or evidence; use synthetic test cards in approved sandbox systems.

Network/scanning/configuration examples require account, target and change scope,

rollback and maintenance windows. New security groups allow outbound traffic by

default; inbound examples alone do not implement CDE egress segmentation.

Cryptographic examples are design choices, not sufficient compliance evidence.

SAQ Types and Applicability

saq_types:
  SAQ_A:
    description: "Card-not-present merchants using fully outsourced payment"
    applies_when:
      - All payment processing fully outsourced to PCI-compliant third party
      - No electronic storage, processing, or transmission of cardholder data
      - Only payment page redirects or iframes from compliant provider

  SAQ_A_EP:
    description: "E-commerce merchants with website that affects payment security"
    applies_when:
      - E-commerce channel only
      - Website controls redirect to or loads payment page from third party
      - No direct processing but website could affect transaction security

  SAQ_B:
    description: "Merchants with only imprint machines or standalone terminals"
    applies_when:
      - Only imprint machines or standalone dial-out terminals; IP terminals require separate B-IP eligibility
      - No electronic cardholder data storage
      - No e-commerce channel

  SAQ_C:
    description: "Merchants with payment application systems connected to internet"
    applies_when:
      - Payment application connected to internet
      - No electronic cardholder data storage
      - No e-commerce channel

  SAQ_D:
    description: "Other merchants and eligible service providers; confirm reporting route with acquirer/brands"
    applies_when:
      - Stores cardholder data electronically
      - Does not fit any other SAQ type
      - Service providers eligible for SAQ D
    requirements: "Full set of PCI DSS requirements"

  scope_reduction_strategies:
    - Use tokenization to replace PAN with non-sensitive tokens
    - Use P2PE (Point-to-Point Encryption) validated solutions
    - Outsource payment processing to reduce your CDE footprint
    - Implement network segmentation to isolate CDE

PCI DSS v4.0.1 Planning Overview

requirements:
  req_1_network_security:
    "1.1": "Network security controls defined and maintained"
    "1.2": "Network security controls configured and maintained"
    "1.3": "Network access to and from CDE is restricted"
    "1.4": "Network connections between trusted and untrusted networks controlled"
    "1.5": "Risks to CDE from devices connecting to untrusted networks mitigated"

  req_2_secure_configuration:
    "2.1": "Secure configuration standards defined and applied"
    "2.2": "System components configured and managed securely"

  req_3_protect_stored_data:
    "3.1": "Processes for protecting stored account data defined"
    "3.2": "Storage of account data is minimized"
    "3.3": "Sensitive authentication data not stored after authorization"
    "3.4": "PAN masked when displayed (BIN and last four maximum, except documented legitimate business access; stricter receipt rules may apply)"
    "3.5": "PAN secured wherever stored"
    "3.6": "Cryptographic keys managed securely"
    "3.7": "Key management procedures documented"

  req_4_transmission_encryption:
    "4.1": "Strong cryptography protects cardholder data during transmission"
    "4.2": "PAN protected when sent via end-user messaging"

  req_5_malware_protection:
    "5.1": "Processes to protect against malware defined"
    "5.2": "Malware prevented or detected and addressed"
    "5.3": "Anti-malware mechanisms active and maintained"
    "5.4": "Anti-phishing mechanisms protect against phishing"

  req_6_secure_development:
    "6.1": "Secure development processes defined"
    "6.2": "Bespoke and custom software developed securely"
    "6.3": "Security vulnerabilities identified and addressed"
    "6.4": "Public-facing web applications protected against attacks"
    "6.5": "Changes to all system components managed securely"

  req_7_access_restriction:
    "7.1": "Access to system components and data restricted by business need"
    "7.2": "Access appropriately defined and assigned"
    "7.3": "Access to system components and data managed via access control"

  req_8_user_identification:
    "8.1": "Processes for user identification defined"
    "8.2": "User identification and accounts managed"
    "8.3": "Strong authentication established"
    "8.4": "MFA implemented for all access into CDE"
    "8.5": "MFA systems configured to prevent misuse"
    "8.6": "System and application accounts managed"

  req_9_physical_access:
    "9.1": "Physical access controls defined"
    "9.2": "Physical access to CDE managed"
    "9.3": "Physical access for personnel and visitors authorized"
    "9.4": "Media with cardholder data managed securely"
    "9.5": "POI devices protected from tampering"

  req_10_logging:
    "10.1": "Audit logging processes defined"
    "10.2": "Audit logs record required events"
    "10.3": "Audit logs protected from destruction and modification"
    "10.4": "Audit logs reviewed for anomalies"
    "10.5": "Audit log history retained (12 months, at least 3 immediately available)"
    "10.6": "Time synchronization mechanisms configured"
    "10.7": "Failures of critical security control systems detected, reported and addressed"

  req_11_testing:
    "11.1": "Security testing processes defined"
    "11.2": "Wireless access points managed"
    "11.3": "Vulnerabilities identified and addressed"
    "11.4": "External and internal penetration testing performed"
    "11.5": "Network intrusions and changes detected and responded to"
    "11.6": "Unauthorized changes to payment pages detected"

  req_12_policies:
    "12.1": "Information security policy established"
    "12.2": "Acceptable use policies defined"
    "12.3": "Risks to CDE formally identified and managed"
    "12.4": "PCI DSS compliance managed"
    "12.5": "PCI DSS scope documented and validated"
    "12.6": "Security awareness program"
    "12.8": "Third-party service providers managed"
    "12.9": "TPSPs acknowledge responsibility for cardholder data"
    "12.10": "Security incidents responded to immediately"

Network Segmentation Architecture

                    ┌──────────────────────────────────────┐
                    │            INTERNET                    │
                    └──────────────┬───────────────────────┘
                                   │
                    ┌──────────────▼───────────────────────┐
                    │       DMZ (Public Subnet)              │
                    │  WAF → Load Balancer → Web Servers     │
                    └──────────────┬───────────────────────┘
                                   │ Firewall (Req 1.3)
                    ┌──────────────▼───────────────────────┐
                    │    CDE (Cardholder Data Environment)   │
                    │  ┌─────────┐  ┌──────────┐            │
                    │  │ Payment │  │ Card DB  │            │
                    │  │ App     │  │(encrypted)│            │
                    │  └─────────┘  └──────────┘            │
                    │  ┌─────────┐  ┌──────────┐            │
                    │  │Token Svc│  │ HSM/KMS  │            │
                    │  └─────────┘  └──────────┘            │
                    └──────────────┬───────────────────────┘
                                   │ Firewall (Req 1.3)
                    ┌──────────────▼───────────────────────┐
                    │     Non-CDE (Corporate Network)        │
                    │  App servers, internal tools            │
                    │  (no cardholder data)                   │
                    └────────

… (full content is in the download package)