# Pci Dss

> When to activate: PCI DSS, PCI compliance, payment card security, cardholder data, SAQ, QSA, card data environment, tokenization, network segmentation

- Skill: `mattakushi432/pci-dss` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mattakushi432/pci-dss`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mattakushi432/pci-dss/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Mattakushi432 (https://skillmd.com/u/mattakushi432)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mattakushi432/pci-dss

---


# PCI DSS Patterns

## Merchant Levels by Transaction Volume

| Level | Visa/MC transactions/year | Compliance path |
|-------|--------------------------|-----------------|
| 1 | > 6 million | On-site QSA audit + ASV scans quarterly |
| 2 | 1–6 million | SAQ + ASV scans quarterly |
| 3 | 20,000–1 million (e-commerce) | SAQ + ASV scans quarterly |
| 4 | < 20,000 (e-commerce) or < 1M (all) | SAQ recommended + ASV scans |

Service providers: Level 1 (> 300K tx/yr) or Level 2 (< 300K).

## Cardholder Data Environment (CDE) Scoping

### What is In-Scope
- Systems that **store** cardholder data (PAN, SAD, CVV, expiry, name)
- Systems that **process** cardholder data (payment page, POS, gateway)
- Systems that **transmit** cardholder data (networks carrying card data)
- Systems **connected to** any of the above (jump servers, AD, monitoring)

### Scope Reduction Strategies
1. **Tokenization** — replace PAN with a token; only token vault is in-scope
2. **Point-to-Point Encryption (P2PE)** — validated P2PE solution can reduce scope to physical terminals only
3. **Redirect / iFrame** — offload payment page to a PCI-certified processor
4. **Network segmentation** — firewall CDE from out-of-scope systems; validate segmentation annually

### Segmentation Validation
- Penetration test the segmentation controls annually (and after significant changes)
- Document all data flows crossing the CDE boundary
- Confirm no cardholder data exists outside the defined CDE

## SAQ Types

| SAQ | Who uses it | Key characteristics |
|-----|------------|---------------------|
| A | Card-not-present merchants, fully outsourced | No electronic storage/processing/transmission |
| A-EP | E-commerce, third-party payment page but own website | JavaScript or redirect from own server |
| B | Imprint machines or standalone dial-out terminals | No electronic cardholder data storage |
| B-IP | IP-connected terminals, no electronic storage | Terminals isolated on network |
| C-VT | Virtual terminal on dedicated computer | Manually entered, no electronic storage |
| C | Payment application connected to internet | No electronic storage of cardholder data |
| D | All other merchants and service providers | Full questionnaire |

## 12 PCI DSS Requirements Summary

| # | Requirement | Key controls |
|---|-------------|-------------|
| 1 | Install and maintain network security controls | Firewall rules, deny-all default, CDE isolation |
| 2 | Apply secure configurations | No vendor defaults, system hardening standards |
| 3 | Protect stored cardholder data | Minimize storage, encrypt PAN at rest, mask display |
| 4 | Protect cardholder data in transit | TLS 1.2+ everywhere, no weak protocols |
| 5 | Protect systems from malware | AV/EDR on all applicable systems, anti-phishing |
| 6 | Develop and maintain secure systems | Patch within 1 month (critical: 1 month), SDLC |
| 7 | Restrict access by business need | Least privilege, role-based access |
| 8 | Identify and authenticate access | Unique IDs, MFA for remote and admin access |
| 9 | Restrict physical access | Badge access, CCTV, visitor logs, media destruction |
| 10 | Log and monitor all access | Audit logs, log review daily, retain 12 months |
| 11 | Test security systems and processes | Quarterly scans, annual pen test, IDS/IPS |
| 12 | Support information security with policies | Written policies, risk assessment annual |

## Encryption Requirements

### Data at Rest
- PAN must be rendered unreadable: strong cryptography (AES-256), truncation, tokenization, or one-way hash
- CVV2/CVC2: **must never be stored** post-authorization (not even encrypted)
- Full magnetic stripe data: **must never be stored**
- PIN/PIN block: **must never be stored**

### Data in Transit
- TLS 1.2 minimum (TLS 1.3 preferred)
- Disable SSL, TLS 1.0, TLS 1.1
- Valid certificates from trusted CA
- No mixed content (HTTP + HTTPS on same page)

## Penetration Testing Requirements

| Type | Frequency | Scope |
|------|-----------|-------|
| External network pen test | Annual + after significant changes | All external-facing CDE IPs |
| Internal network pen test | Annual + after significant changes | All internal CDE systems |
| Application layer pen test | Annual + after significant changes | Payment application, APIs |
| Segmentation test | Annual + after significant changes | Validate CDE isolation |

### Pen Test Minimum Coverage
- All CDE IP addresses and web application surfaces
- Testing from both internal and external perspectives
- Exploit vulnerabilities — not just discover them
- Retain results and evidence of remediation

## QSA Engagement Guide

### When You Need a QSA
- Level 1 merchants (required)
- Level 1 service providers (required)
- Level 2 merchants opting for on-site assessment over SAQ

### QSA Engagement Phases
1. **Scoping** — define CDE boundary, agree on scope document
2. **Gap assessment** (optional) — identify gaps before formal audit
3. **Remediation** — fix identified gaps
4. **Assessment** — QSA validates controls, interviews staff, inspects evidence
5. **Report on Compliance (ROC)** — formal output; file with acquirer

### Evidence to Prepare
- Network diagrams showing CDE segmentation
- Data flow diagrams for cardholder data
- Firewall rule sets and change logs
- System hardening standards and evidence of application
- Patch levels for all in-scope systems
- Access control lists and user account inventory
- Log samples and review evidence
- Penetration test reports with remediation evidence
- Policies and procedures documents
- Training completion records

## Common Compliance Gaps

| Gap | Fix |
|-----|-----|
| Default passwords not changed | Inventory all systems; enforce password change at provisioning |
| CVV stored in logs | Audit all log outputs; mask or remove CVV from logs |
| No MFA for admin access | Enforce MFA for all non-console administrative access |
| Logs not reviewed daily | Automate log review with SIEM alerts; document review |
| No formal change control | Implement change management process with approval workflow |
| SAQ scope understated | Map all systems touching cardholder data; include connected systems |
| Pen test only external | Must include internal and application layer testing |
| Missing patch for > 1 month | Automate patch scanning; track SLA breach |