PCI DSS Compliance

Implement PCI DSS v4.0 requirements for protecting cardholder data across the Cardholder Data Environment (CDE), including network segmentation, encryption, access controls, and ongoing testing.

When to Use

• Processing, storing, or transmitting payment card data
• Scoping the Cardholder Data Environment for PCI assessment
• Selecting the appropriate Self-Assessment Questionnaire (SAQ)
• Implementing network segmentation to reduce CDE scope
• Preparing for QSA assessment or ASV scanning

SAQ Types and Applicability

saq_types:
  SAQ_A:
    description: "Card-not-present merchants using fully outsourced payment"
    applies_when:
      - All payment processing fully outsourced to PCI-compliant third party
      - No electronic storage, processing, or transmission of cardholder data
      - Only payment page redirects or iframes from compliant provider
    requirements: ~22 questions

  SAQ_A_EP:
    description: "E-commerce merchants with website that affects payment security"
    applies_when:
      - E-commerce channel only
      - Website controls redirect to or loads payment page from third party
      - No direct processing but website could affect transaction security
    requirements: ~191 questions

  SAQ_B:
    description: "Merchants with only imprint machines or standalone terminals"
    applies_when:
      - Only standalone POS terminals (dial-out or IP connected)
      - No electronic cardholder data storage
      - No e-commerce channel
    requirements: ~41 questions

  SAQ_C:
    description: "Merchants with payment application systems connected to internet"
    applies_when:
      - Payment application connected to internet
      - No electronic cardholder data storage
      - No e-commerce channel
    requirements: ~160 questions

  SAQ_D:
    description: "All other merchants and all service providers"
    applies_when:
      - Stores cardholder data electronically
      - Does not fit any other SAQ type
      - Service providers eligible for SAQ D
    requirements: "Full set of PCI DSS requirements"

  scope_reduction_strategies:
    - Use tokenization to replace PAN with non-sensitive tokens
    - Use P2PE (Point-to-Point Encryption) validated solutions
    - Outsource payment processing to reduce your CDE footprint
    - Implement network segmentation to isolate CDE

PCI DSS v4.0 Requirements Overview

requirements:
  req_1_network_security:
    "1.1": "Network security controls defined and maintained"
    "1.2": "Network security controls configured and maintained"
    "1.3": "Network access to and from CDE is restricted"
    "1.4": "Network connections between trusted and untrusted networks controlled"
    "1.5": "Risks to CDE from devices connecting to untrusted networks mitigated"

  req_2_secure_configuration:
    "2.1": "Secure configuration standards defined and applied"
    "2.2": "System components configured and managed securely"

  req_3_protect_stored_data:
    "3.1": "Processes for protecting stored account data defined"
    "3.2": "Storage of account data is minimized"
    "3.3": "Sensitive authentication data not stored after authorization"
    "3.4": "PAN masked when displayed (first 6, last 4 maximum)"
    "3.5": "PAN secured wherever stored"
    "3.6": "Cryptographic keys managed securely"
    "3.7": "Key management procedures documented"

  req_4_transmission_encryption:
    "4.1": "Strong cryptography protects cardholder data during transmission"
    "4.2": "PAN protected when sent via end-user messaging"

  req_5_malware_protection:
    "5.1": "Processes to protect against malware defined"
    "5.2": "Malware prevented or detected and addressed"
    "5.3": "Anti-malware mechanisms active and maintained"
    "5.4": "Anti-phishing mechanisms protect against phishing"

  req_6_secure_development:
    "6.1": "Secure development processes defined"
    "6.2": "Bespoke and custom software developed securely"
    "6.3": "Security vulnerabilities identified and addressed"
    "6.4": "Public-facing web applications protected against attacks"
    "6.5": "Changes to all system components managed securely"

  req_7_access_restriction:
    "7.1": "Access to system components and data restricted by business need"
    "7.2": "Access appropriately defined and assigned"
    "7.3": "Access to system components and data managed via access control"

  req_8_user_identification:
    "8.1": "Processes for user identification defined"

…