1---2name: pci-dss3description: When to activate: PCI DSS, PCI compliance, payment card security, cardholder data, SAQ, QSA, card data environment, tokenization, network segmentation4---56# PCI DSS Patterns78## Merchant Levels by Transaction Volume910| Level | Visa/MC transactions/year | Compliance path |11|-------|--------------------------|-----------------|12| 1 | > 6 million | On-site QSA audit + ASV scans quarterly |13| 2 | 1–6 million | SAQ + ASV scans quarterly |14| 3 | 20,000–1 million (e-commerce) | SAQ + ASV scans quarterly |15| 4 | < 20,000 (e-commerce) or < 1M (all) | SAQ recommended + ASV scans |1617Service providers: Level 1 (> 300K tx/yr) or Level 2 (< 300K).1819## Cardholder Data Environment (CDE) Scoping2021### What is In-Scope22- Systems that **store** cardholder data (PAN, SAD, CVV, expiry, name)23- Systems that **process** cardholder data (payment page, POS, gateway)24- Systems that **transmit** cardholder data (networks carrying card data)25- Systems **connected to** any of the above (jump servers, AD, monitoring)2627### Scope Reduction Strategies281. **Tokenization** — replace PAN with a token; only token vault is in-scope292. **Point-to-Point Encryption (P2PE)** — validated P2PE solution can reduce scope to physical terminals only303. **Redirect / iFrame** — offload payment page to a PCI-certified processor314. **Network segmentation** — firewall CDE from out-of-scope systems; validate segmentation annually3233### Segmentation Validation34- Penetration test the segmentation controls annually (and after significant changes)35- Document all data flows crossing the CDE boundary36- Confirm no cardholder data exists outside the defined CDE3738## SAQ Types3940| SAQ | Who uses it | Key characteristics |41|-----|------------|---------------------|42| A | Card-not-present merchants, fully outsourced | No electronic storage/processing/transmission |43| A-EP | E-commerce, third-party payment page but own website | JavaScript or redirect from own server |44| B | Imprint machines or standalone dial-out terminals | No electronic cardholder data storage |45| B-IP | IP-connected terminals, no electronic storage | Terminals isolated on network |46| C-VT | Virtual terminal on dedicated computer | Manually entered, no electronic storage |47| C | Payment application connected to internet | No electronic storage of cardholder data |48| D | All other merchants and service providers | Full questionnaire |4950## 12 PCI DSS Requirements Summary5152| # | Requirement | Key controls |53|---|-------------|-------------|54| 1 | Install and maintain network security controls | Firewall rules, deny-all default, CDE isolation |55| 2 | Apply secure configurations | No vendor defaults, system hardening standards |56| 3 | Protect stored cardholder data | Minimize storage, encrypt PAN at rest, mask display |57| 4 | Protect cardholder data in transit | TLS 1.2+ everywhere, no weak protocols |58| 5 | Protect systems from malware | AV/EDR on all applicable systems, anti-phishing |59| 6 | Develop and maintain secure systems | Patch within 1 month (critical: 1 month), SDLC |60| 7 | Restrict access by business need | Least privilege, role-based access |61| 8 | Identify and authenticate access | Unique IDs, MFA for remote and admin access |62| 9 | Restrict physical access | Badge access, CCTV, visitor logs, media destruction |63| 10 | Log and monitor all access | Audit logs, log review daily, retain 12 months |64| 11 | Test security systems and processes | Quarterly scans, annual pen test, IDS/IPS |65| 12 | Support information security with policies | Written policies, risk assessment annual |6667## Encryption Requirements6869### Data at Rest70- PAN must be rendered unreadable: strong cryptography (AES-256), truncation, tokenization, or one-way hash71- CVV2/CVC2: **must never be stored** post-authorization (not even encrypted)72- Full magnetic stripe data: **must never be stored**73- PIN/PIN block: **must never be stored**7475### Data in Transit76- TLS 1.2 minimum (TLS 1.3 preferred)77- Disable SSL, TLS 1.0, TLS 1.178- Valid certificates from trusted CA79- No mixed content (HTTP + HTTPS on same page)8081## Penetration Testing Requirements8283| Type | Frequency | Scope |84|------|-----------|-------|85| External network pen test | Annual + after significant changes | All external-facing CDE IPs |86| Internal network pen test | Annual + after significant changes | All internal CDE systems |87| Application layer pen test | Annual + after significant changes | Payment application, APIs |88| Segmentation test | Annual + after significant changes | Validate CDE isolation |8990### Pen Test Minimum Coverage91- All CDE IP addresses and web application surfaces92- Testing from both internal and external perspectives93- Exploit vulnerabilities — not just discover them94- Retain results and evidence of remediation9596## QSA Engagement Guide9798### When You Need a QSA99- Level 1 merchants (required)100- Level 1 service providers (required)101- Level 2 merchants opting for on-site assessment over SAQ102103### QSA Engagement Phases1041. **Scoping** — define CDE boundary, agree on scope document1052. **Gap assessment** (optional) — identify gaps before formal audit1063. **Remediation** — fix identified gaps1074. **Assessment** — QSA validates controls, interviews staff, inspects evidence1085. **Report on Compliance (ROC)** — formal output; file with acquirer109110### Evidence to Prepare111- Network diagrams showing CDE segmentation112- Data flow diagrams for cardholder data113- Firewall rule sets and change logs114- System hardening standards and evidence of application115- Patch levels for all in-scope systems116- Access control lists and user account inventory117- Log samples and review evidence118- Penetration test reports with remediation evidence119- Policies and procedures documents120- Training completion records121122## Common Compliance Gaps123124| Gap | Fix |125|-----|-----|126| Default passwords not changed | Inventory all systems; enforce password change at provisioning |127| CVV stored in logs | Audit all log outputs; mask or remove CVV from logs |128| No MFA for admin access | Enforce MFA for all non-console administrative access |129| Logs not reviewed daily | Automate log review with SIEM alerts; document review |130| No formal change control | Implement change management process with approval workflow |131| SAQ scope understated | Map all systems touching cardholder data; include connected systems |132| Pen test only external | Must include internal and application layer testing |133| Missing patch for > 1 month | Automate patch scanning; track SLA breach |
Mattakushi432