Pci dss

PCI DSS Patterns

Merchant Levels by Transaction Volume

Level	Visa/MC transactions/year	Compliance path
1	> 6 million	On-site QSA audit + ASV scans quarterly
2	1–6 million	SAQ + ASV scans quarterly
3	20,000–1 million (e-commerce)	SAQ + ASV scans quarterly
4	< 20,000 (e-commerce) or < 1M (all)	SAQ recommended + ASV scans

Service providers: Level 1 (> 300K tx/yr) or Level 2 (< 300K).

Cardholder Data Environment (CDE) Scoping

What is In-Scope

• Systems that store cardholder data (PAN, SAD, CVV, expiry, name)
• Systems that process cardholder data (payment page, POS, gateway)
• Systems that transmit cardholder data (networks carrying card data)
• Systems connected to any of the above (jump servers, AD, monitoring)

Scope Reduction Strategies

1. Tokenization — replace PAN with a token; only token vault is in-scope
2. Point-to-Point Encryption (P2PE) — validated P2PE solution can reduce scope to physical terminals only
3. Redirect / iFrame — offload payment page to a PCI-certified processor
4. Network segmentation — firewall CDE from out-of-scope systems; validate segmentation annually

Segmentation Validation

• Penetration test the segmentation controls annually (and after significant changes)
• Document all data flows crossing the CDE boundary
• Confirm no cardholder data exists outside the defined CDE

SAQ Types

SAQ	Who uses it	Key characteristics
A	Card-not-present merchants, fully outsourced	No electronic storage/processing/transmission
A-EP	E-commerce, third-party payment page but own website	JavaScript or redirect from own server
B	Imprint machines or standalone dial-out terminals	No electronic cardholder data storage
B-IP	IP-connected terminals, no electronic storage	Terminals isolated on network
C-VT	Virtual terminal on dedicated computer	Manually entered, no electronic storage
C	Payment application connected to internet	No electronic storage of cardholder data
D	All other merchants and service providers	Full questionnaire

12 PCI DSS Requirements Summary

#	Requirement	Key controls
1	Install and maintain network security controls	Firewall rules, deny-all default, CDE isolation
2	Apply secure configurations	No vendor defaults, system hardening standards
3	Protect stored cardholder data	Minimize storage, encrypt PAN at rest, mask display
4	Protect cardholder data in transit	TLS 1.2+ everywhere, no weak protocols
5	Protect systems from malware	AV/EDR on all applicable systems, anti-phishing
6	Develop and maintain secure systems	Patch within 1 month (critical: 1 month), SDLC
7	Restrict access by business need	Least privilege, role-based access
8	Identify and authenticate access	Unique IDs, MFA for remote and admin access
9	Restrict physical access	Badge access, CCTV, visitor logs, media destruction
10	Log and monitor all access	Audit logs, log review daily, retain 12 months
11	Test security systems and processes	Quarterly scans, annual pen test, IDS/IPS
12	Support information security with policies	Written policies, risk assessment annual

Encryption Requirements

Data at Rest

• PAN must be rendered unreadable: strong cryptography (AES-256), truncation, tokenization, or one-way hash
• CVV2/CVC2: must never be stored post-authorization (not even encrypted)
• Full magnetic stripe data: must never be stored
• PIN/PIN block: must never be stored

Data in Transit

• TLS 1.2 minimum (TLS 1.3 preferred)
• Disable SSL, TLS 1.0, TLS 1.1
• Valid certificates from trusted CA
• No mixed content (HTTP + HTTPS on same page)

Penetration Testing Requirements

Type	Frequency	Scope
External network pen test	Annual + after significant changes	All external-facing CDE IPs
Internal network pen test	Annual + after significant changes	All internal CDE systems
Application layer pen test	Annual + after significant changes	Payment application, APIs
Segmentation test	Annual + after significant changes	Validate CDE isolation

Pen Test Minimum Coverage

• All CDE IP addresses and web application surfaces
• Testing from both internal and external perspectives
• Exploit vulnerabilities — not just discover them
• Retain results and evidence of remediation

QSA Engagement Guide

When You Need a QSA

• Level 1 merchants (required)
• Level 1 service providers (required)
• Level 2 merchants opting for on-site assessment over SAQ

QSA Engagement Phases

1. Scoping — define CDE boundary, agree on scope document
2. Gap assessment (optional) — identify gaps before formal audit
3. Remediation — fix identified gaps
4. Assessment — QSA validates controls, interviews staff, inspects evidence
5. Report on Compliance (ROC) — formal output; file with acquirer

Evidence to Prepare

• Network diagrams showing CDE segmentation
• Data flow diagrams for cardholder data
• Firewall rule sets and change logs
• System hardening standards and evidence of application
• Patch levels for all in-scope systems
• Access control lists and user account inventory
• Log samples and review evidence
• Penetration test reports with remediation evidence
• Policies and procedures documents
• Training completion records

Common Compliance Gaps

Gap	Fix
Default passwords not changed	Inventory all systems; enforce password change at provisioning
CVV stored in logs	Audit all log outputs; mask or remove CVV from logs
No MFA for admin access	Enforce MFA for all non-console administrative access
Logs not reviewed daily	Automate log review with SIEM alerts; document review
No formal change control	Implement change management process with approval workflow
SAQ scope understated	Map all systems touching cardholder data; include connected systems
Pen test only external	Must include internal and application layer testing
Missing patch for > 1 month	Automate patch scanning; track SLA breach