PCI DSS Compliance and Security

  1. Scoping for PCI DSS Compliance
    1. Fundamental Scoping Principles
      1. People Component
        1. Employees with CHD Access
          1. Contractors and Vendors
            1. Third-Party Personnel
            2. Processes Component
              1. CHD Handling Procedures
                1. Payment Processing Workflows
                  1. Data Management Processes
                  2. Technology Component
                    1. System Components
                      1. Network Infrastructure
                        1. Applications and Databases
                      2. Identifying Systems in Scope
                        1. Systems that Store CHD
                          1. Databases
                            1. File Systems
                              1. Backup Systems
                                1. Log Files
                                2. Systems that Process CHD
                                  1. Point-of-Sale Systems
                                    1. Payment Applications
                                      1. Web Applications
                                        1. Mobile Applications
                                          1. Payment Gateways
                                          2. Systems that Transmit CHD
                                            1. Network Equipment
                                              1. Communication Systems
                                                1. Wireless Networks
                                                  1. VPN Connections
                                                  2. Connected-to Systems
                                                    1. Direct Network Connections
                                                      1. Shared Network Segments
                                                        1. Jump Servers
                                                          1. Management Systems
                                                          2. Security-Impacting Systems
                                                            1. Authentication Systems
                                                              1. Security Management Platforms
                                                                1. Monitoring Systems
                                                                  1. Backup Systems
                                                                2. Network Segmentation
                                                                  1. Segmentation Concepts
                                                                    1. Logical Segmentation
                                                                      1. Physical Segmentation
                                                                        1. Micro-segmentation
                                                                        2. Segmentation Technologies
                                                                          1. Firewalls
                                                                            1. Virtual LANs (VLANs)
                                                                              1. Access Control Lists (ACLs)
                                                                                1. Software-Defined Networking
                                                                                  1. Network Access Control (NAC)
                                                                                  2. Segmentation Implementation
                                                                                    1. Network Architecture Design
                                                                                      1. Traffic Flow Analysis
                                                                                        1. Access Control Policies
                                                                                          1. Monitoring and Logging
                                                                                          2. Segmentation Validation
                                                                                            1. Penetration Testing
                                                                                              1. Network Discovery Scans
                                                                                                1. Configuration Reviews
                                                                                                  1. Documentation Requirements
                                                                                                2. Scope Reduction Strategies
                                                                                                  1. Tokenization
                                                                                                    1. Token Generation Methods
                                                                                                      1. Token Mapping Systems
                                                                                                        1. Tokenization Providers
                                                                                                          1. Implementation Considerations
                                                                                                          2. Point-to-Point Encryption (P2PE)
                                                                                                            1. Hardware Security Modules
                                                                                                              1. Encryption Key Management
                                                                                                                1. PCI-Listed P2PE Solutions
                                                                                                                  1. Hybrid P2PE Solutions
                                                                                                                  2. Outsourcing Strategies
                                                                                                                    1. Payment Processing Outsourcing
                                                                                                                      1. Hosted Payment Pages
                                                                                                                        1. Third-Party Service Providers
                                                                                                                          1. Cloud Service Providers
                                                                                                                          2. Data Minimization
                                                                                                                            1. Data Retention Policies
                                                                                                                              1. Data Purging Procedures
                                                                                                                                1. Alternative Data Storage
                                                                                                                              2. Scoping Documentation
                                                                                                                                1. Network Diagrams
                                                                                                                                  1. Current State Documentation
                                                                                                                                    1. Data Flow Diagrams
                                                                                                                                      1. Segmentation Boundaries
                                                                                                                                      2. Asset Inventories
                                                                                                                                        1. System Component Lists
                                                                                                                                          1. Software Inventories
                                                                                                                                            1. Network Device Catalogs
                                                                                                                                            2. Data Flow Analysis
                                                                                                                                              1. CHD Entry Points
                                                                                                                                                1. Processing Locations
                                                                                                                                                  1. Storage Locations
                                                                                                                                                    1. Transmission Paths
                                                                                                                                                      1. Exit Points

                                                                                                                                                  Previous

                                                                                                                                                  2. Understanding PCI DSS Requirements Structure

                                                                                                                                                  Go to top

                                                                                                                                                  Next

                                                                                                                                                  4. The 12 Requirements of PCI DSS