pci-dss-compliance

Name: pci-dss-compliance
Author: BagelHole

42stars4forks

How to install pci-dss-compliance?

bagelhole/devops-security-agent-skills/pci-dss-compliance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill pci-dss-compliance

Installs into the current project.

Summary

Implement PCI DSS requirements for payment card data. Configure cardholder data environment and security controls. Use when processing payment cards.

Files · 1

View on GitHub

SKILL.md

1	# PCI DSS Compliance
2
3	Implement PCI DSS v4.0 requirements for protecting cardholder data across the Cardholder Data Environment (CDE), including network segmentation, encryption, access controls, and ongoing testing.
4
5	## When to Use
6
7	- Processing, storing, or transmitting payment card data
8	- Scoping the Cardholder Data Environment for PCI assessment
9	- Selecting the appropriate Self-Assessment Questionnaire (SAQ)
10	- Implementing network segmentation to reduce CDE scope
11	- Preparing for QSA assessment or ASV scanning
12
13	## SAQ Types and Applicability
14
15	```yaml
16	saq_types:
17	SAQ_A:
18	description: "Card-not-present merchants using fully outsourced payment"
19	applies_when:
20	- All payment processing fully outsourced to PCI-compliant third party
21	- No electronic storage, processing, or transmission of cardholder data
22	- Only payment page redirects or iframes from compliant provider
23	requirements: ~22 questions
24
25	SAQ_A_EP:
26	description: "E-commerce merchants with website that affects payment security"
27	applies_when:
28	- E-commerce channel only
29	- Website controls redirect to or loads payment page from third party
30	- No direct processing but website could affect transaction security
31	requirements: ~191 questions
32
33	SAQ_B:
34	description: "Merchants with only imprint machines or standalone terminals"
35	applies_when:
36	- Only standalone POS terminals (dial-out or IP connected)
37	- No electronic cardholder data storage
38	- No e-commerce channel
39	requirements: ~41 questions
40
41	SAQ_C:
42	description: "Merchants with payment application systems connected to internet"
43	applies_when:
44	- Payment application connected to internet
45	- No electronic cardholder data storage
46	- No e-commerce channel
47	requirements: ~160 questions
48
49	SAQ_D:
50	description: "All other merchants and all service providers"
51	applies_when:
52	- Stores cardholder data electronically
53	- Does not fit any other SAQ type
54	- Service providers eligible for SAQ D
55	requirements: "Full set of PCI DSS requirements"
56
57	scope_reduction_strategies:
58	- Use tokenization to replace PAN with non-sensitive tokens
59	- Use P2PE (Point-to-Point Encryption) validated solutions
60	- Outsource payment processing to reduce your CDE footprint
61	- Implement network segmentation to isolate CDE
62	```
63
64	## PCI DSS v4.0 Requirements Overview
65
66	```yaml
67	requirements:
68	req_1_network_security:
69	"1.1": "Network security controls defined and maintained"
70	"1.2": "Network security controls configured and maintained"
71	"1.3": "Network access to and from CDE is restricted"
72	"1.4": "Network connections between trusted and untrusted networks controlled"
73	"1.5": "Risks to CDE from devices connecting to untrusted networks mitigated"
74
75	req_2_secure_configuration:
76	"2.1": "Secure configuration standards defined and applied"
77	"2.2": "System components configured and managed securely"
78
79	req_3_protect_stored_data:
80	"3.1": "Processes for protecting stored account data defined"
81	"3.2": "Storage of account data is minimized"
82	"3.3": "Sensitive authentication data not stored after authorization"
83	"3.4": "PAN masked when displayed (first 6, last 4 maximum)"
84	"3.5": "PAN secured wherever stored"
85	"3.6": "Cryptographic keys managed securely"
86	"3.7": "Key management procedures documented"
87
88	req_4_transmission_encryption:
89	"4.1": "Strong cryptography protects cardholder data during transmission"
90	"4.2": "PAN protected when sent via end-user messaging"
91
92	req_5_malware_protection:
93	"5.1": "Processes to protect against malware defined"
94	"5.2": "Malware prevented or detected and addressed"
95	"5.3": "Anti-malware mechanisms active and maintained"
96	"5.4": "Anti-phishing mechanisms protect against phishing"
97
98	req_6_secure_development:
99	"6.1": "Secure development processes defined"
100	"6.2": "Bespoke and custom software developed securely"
101	"6.3": "Security vulnerabilities identified and addressed"
102	"6.4": "Public-facing web applications protected against attacks"
103	"6.5": "Changes to all system components managed securely"
104
105	req_7_access_restriction:
106	"7.1": "Access to system components and data restricted by business need"
107	"7.2": "Access appropriately defined and assigned"
108	"7.3": "Access to system components and data managed via access control"
109
110	req_8_user_identification:
111	"8.1": "Processes for user identification defined"
112	"8.2": "User identification and accounts managed"
113	"8.3": "Strong authentication established"
114	"8.4": "MFA implemented for all access into CDE"
115	"8.5": "MFA systems configured to prevent misuse"
116	"8.6": "System and application accounts

People who liked this also viewed

6 picks

Type

pci-dss-compliance

42stars4forks

View on GitHub

How to install pci-dss-compliance?

bagelhole/devops-security-agent-skills/pci-dss-compliance

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill pci-dss-compliance

Installs into the current project.

Summary

Implement PCI DSS requirements for payment card data. Configure cardholder data environment and security controls. Use when processing payment cards.

Files · 1

View on GitHub

SKILL.md

1	# PCI DSS Compliance
2
3	Implement PCI DSS v4.0 requirements for protecting cardholder data across the Cardholder Data Environment (CDE), including network segmentation, encryption, access controls, and ongoing testing.
4
5	## When to Use
6
7	- Processing, storing, or transmitting payment card data
8	- Scoping the Cardholder Data Environment for PCI assessment
9	- Selecting the appropriate Self-Assessment Questionnaire (SAQ)
10	- Implementing network segmentation to reduce CDE scope
11	- Preparing for QSA assessment or ASV scanning
12
13	## SAQ Types and Applicability
14
15	```yaml
16	saq_types:
17	SAQ_A:
18	description: "Card-not-present merchants using fully outsourced payment"
19	applies_when:
20	- All payment processing fully outsourced to PCI-compliant third party
21	- No electronic storage, processing, or transmission of cardholder data
22	- Only payment page redirects or iframes from compliant provider
23	requirements: ~22 questions
24
25	SAQ_A_EP:
26	description: "E-commerce merchants with website that affects payment security"
27	applies_when:
28	- E-commerce channel only
29	- Website controls redirect to or loads payment page from third party
30	- No direct processing but website could affect transaction security
31	requirements: ~191 questions
32
33	SAQ_B:
34	description: "Merchants with only imprint machines or standalone terminals"
35	applies_when:
36	- Only standalone POS terminals (dial-out or IP connected)
37	- No electronic cardholder data storage
38	- No e-commerce channel
39	requirements: ~41 questions
40
41	SAQ_C:
42	description: "Merchants with payment application systems connected to internet"
43	applies_when:
44	- Payment application connected to internet
45	- No electronic cardholder data storage
46	- No e-commerce channel
47	requirements: ~160 questions
48
49	SAQ_D:
50	description: "All other merchants and all service providers"
51	applies_when:
52	- Stores cardholder data electronically
53	- Does not fit any other SAQ type
54	- Service providers eligible for SAQ D
55	requirements: "Full set of PCI DSS requirements"
56
57	scope_reduction_strategies:
58	- Use tokenization to replace PAN with non-sensitive tokens
59	- Use P2PE (Point-to-Point Encryption) validated solutions
60	- Outsource payment processing to reduce your CDE footprint
61	- Implement network segmentation to isolate CDE
62	```
63
64	## PCI DSS v4.0 Requirements Overview
65
66	```yaml
67	requirements:
68	req_1_network_security:
69	"1.1": "Network security controls defined and maintained"
70	"1.2": "Network security controls configured and maintained"
71	"1.3": "Network access to and from CDE is restricted"
72	"1.4": "Network connections between trusted and untrusted networks controlled"
73	"1.5": "Risks to CDE from devices connecting to untrusted networks mitigated"
74
75	req_2_secure_configuration:
76	"2.1": "Secure configuration standards defined and applied"
77	"2.2": "System components configured and managed securely"
78
79	req_3_protect_stored_data:
80	"3.1": "Processes for protecting stored account data defined"
81	"3.2": "Storage of account data is minimized"
82	"3.3": "Sensitive authentication data not stored after authorization"
83	"3.4": "PAN masked when displayed (first 6, last 4 maximum)"
84	"3.5": "PAN secured wherever stored"
85	"3.6": "Cryptographic keys managed securely"
86	"3.7": "Key management procedures documented"
87
88	req_4_transmission_encryption:
89	"4.1": "Strong cryptography protects cardholder data during transmission"
90	"4.2": "PAN protected when sent via end-user messaging"
91
92	req_5_malware_protection:
93	"5.1": "Processes to protect against malware defined"
94	"5.2": "Malware prevented or detected and addressed"
95	"5.3": "Anti-malware mechanisms active and maintained"
96	"5.4": "Anti-phishing mechanisms protect against phishing"
97
98	req_6_secure_development:
99	"6.1": "Secure development processes defined"
100	"6.2": "Bespoke and custom software developed securely"
101	"6.3": "Security vulnerabilities identified and addressed"
102	"6.4": "Public-facing web applications protected against attacks"
103	"6.5": "Changes to all system components managed securely"
104
105	req_7_access_restriction:
106	"7.1": "Access to system components and data restricted by business need"
107	"7.2": "Access appropriately defined and assigned"
108	"7.3": "Access to system components and data managed via access control"
109
110	req_8_user_identification:
111	"8.1": "Processes for user identification defined"
112	"8.2": "User identification and accounts managed"
113	"8.3": "Strong authentication established"
114	"8.4": "MFA implemented for all access into CDE"
115	"8.5": "MFA systems configured to prevent misuse"
116	"8.6": "System and application accounts

People who liked this also viewed

6 picks

Type