Skill v1.0.1
currentAutomated scan100/1004 files
version: "1.0.1" name: pci-dss-compliance description: PCI DSS compliance planning for payment card handling including scope reduction, SAQ selection, and security controls allowed-tools: Read, Glob, Grep, Write, Edit, Task
PCI DSS Compliance Planning
Comprehensive guidance for Payment Card Industry Data Security Standard compliance before development begins.
When to Use This Skill
- Building e-commerce or payment processing systems
- Integrating with payment gateways or processors
- Designing scope reduction strategies (tokenization, P2PE)
- Selecting appropriate SAQ for your business
- Preparing for PCI DSS assessments
PCI DSS Fundamentals
Cardholder Data Elements
| Data Element | Description | Storage Permitted? | Protection Required | |
|---|---|---|---|---|
| PAN | Primary Account Number (16 digits) | Yes, if protected | Render unreadable | |
| Cardholder Name | Name on card | Yes | Protect per requirement | |
| Service Code | 3-4 digit code | Yes | Protect per requirement | |
| Expiration Date | MM/YY | Yes | Protect per requirement | |
| CVV/CVC | Card verification value | NEVER after auth | N/A - never store | |
| PIN/PIN Block | Personal identification | NEVER after auth | N/A - never store | |
| Full Track Data | Magnetic stripe data | NEVER after auth | N/A - never store |
The 12 Requirements (PCI DSS 4.0)
Goal 1: Build and Maintain a Secure Network and Systems1. Install and maintain network security controls2. Apply secure configurations to all system componentsGoal 2: Protect Account Data3. Protect stored account data4. Protect cardholder data with strong cryptography during transmissionGoal 3: Maintain a Vulnerability Management Program5. Protect all systems and networks from malicious software6. Develop and maintain secure systems and softwareGoal 4: Implement Strong Access Control Measures7. Restrict access to cardholder data by business need-to-know8. Identify users and authenticate access to system components9. Restrict physical access to cardholder dataGoal 5: Regularly Monitor and Test Networks10. Log and monitor all access to system components and cardholder data11. Test security of systems and networks regularlyGoal 6: Maintain an Information Security Policy12. Support information security with organizational policies and programs
Scope Reduction Strategies
Understanding PCI Scope
In Scope: Any system that stores, processes, or transmits cardholder data, OR connects to systems that do.
Scope Reduction Goal: Minimize systems handling raw cardholder data.
Strategy 1: Tokenization
Replace PAN with non-sensitive token; processor stores actual card data.
// Client-side tokenization flowpublic class PaymentTokenization{private readonly IPaymentGateway _gateway;public async Task<PaymentResult> ProcessPayment(string clientToken, // Token created in browser via gateway's JSdecimal amount,string currency,CancellationToken ct){// Server never sees raw card data - only tokenvar request = new ChargeRequest{Token = clientToken,Amount = amount,Currency = currency,MerchantReference = Guid.NewGuid().ToString()};// Token is exchanged for payment at gatewayvar result = await _gateway.Charge(request, ct);// Store only the transaction reference, never card datareturn new PaymentResult{TransactionId = result.TransactionId,Status = result.Status,// Store token for recurring payments (if vaulted)VaultToken = result.VaultToken};}}// Scope: Only gateway SDK is in scope, not your entire application
Strategy 2: Hosted Payment Page (Redirect)
Customer enters card data on processor's page; you never handle card data.
public class HostedPaymentFlow{private readonly IHostedPaymentProvider _provider;public async Task<string> CreatePaymentSession(Order order,CancellationToken ct){var session = await _provider.CreateSession(new SessionRequest{Amount = order.Total,Currency = order.Currency,SuccessUrl = $"https://example.com/payment/success?order={order.Id}",CancelUrl = $"https://example.com/payment/cancel?order={order.Id}",WebhookUrl = "https://example.com/api/payment-webhook",Metadata = new Dictionary<string, string>{["order_id"] = order.Id.ToString()}}, ct);// Redirect customer to processor's hosted pagereturn session.RedirectUrl;}// Webhook receives payment confirmation - no card datapublic async Task HandleWebhook(PaymentWebhook webhook, CancellationToken ct){// Verify webhook signatureif (!_provider.VerifySignature(webhook))throw new SecurityException("Invalid webhook signature");// Update order statusvar orderId = Guid.Parse(webhook.Metadata["order_id"]);await _orderService.MarkPaid(orderId, webhook.TransactionId, ct);}}
Strategy 3: iFrame/Embedded Fields
Card fields are hosted by processor but appear on your page.
<!-- Stripe Elements example - fields hosted by Stripe --><form id="payment-form"><div id="card-element"><!-- Stripe injects secure card input here --></div><button type="submit">Pay</button></form><script>// Card data never touches your serverconst stripe = Stripe('pk_live_xxx');const elements = stripe.elements();const cardElement = elements.create('card');cardElement.mount('#card-element');form.addEventListener('submit', async (e) => {e.preventDefault();// Token created client-side, sent to your serverconst {token} = await stripe.createToken(cardElement);// Only token goes to your serverawait fetch('/api/payment', {method: 'POST',body: JSON.stringify({ token: token.id })});});</script>
Strategy 4: Point-to-Point Encryption (P2PE)
Hardware encrypts card data at swipe; decryption only at processor.
Card Swipe → P2PE Terminal → Encrypted → Your Systems → Processor(can't decrypt)Benefits:- Your systems handle encrypted data only- Dramatically reduced scope- Requires P2PE validated solution
Scope Reduction Comparison
| Strategy | Your PCI Scope | SAQ Type | Complexity | |
|---|---|---|---|---|
| Store raw cards | Full environment | D | Very High | |
| Tokenization (API) | Token handling systems | A-EP or D | Medium | |
| iFrame/Hosted Fields | Minimal (web page) | A or A-EP | Low | |
| Redirect to Processor | None (referrer only) | A | Very Low | |
| P2PE Hardware | Terminal + network | P2PE | Low |
SAQ Selection Guide
SAQ Types Overview
| SAQ | Applies To | Requirements | Questions | |
|---|---|---|---|---|
| A | E-commerce, all card functions outsourced | No CHD on your systems | ~24 | |
| A-EP | E-commerce, website impacts card security | iFrame/JS approach | ~191 | |
| B | Imprint/standalone dial terminals only | No electronic storage | ~41 | |
| B-IP | Standalone IP-connected terminals | No electronic storage | ~82 | |
| C | Payment app on internet-connected systems | No electronic storage | ~160 | |
| C-VT | Virtual terminal, no electronic storage | Web-based, no storage | ~79 | |
| D | All other merchants | Full requirements | ~329 | |
| D (SP) | Service providers | Full requirements | ~400+ | |
| P2PE | Using validated P2PE solution | Terminal + P2PE | ~33 |
Decision Tree
Do you store/process/transmit CHD electronically?├─ NO: Are you e-commerce only?│ ├─ YES: All card functions outsourced?│ │ ├─ YES → SAQ A│ │ └─ NO: Website controls redirect/iFrame?│ │ ├─ YES → SAQ A-EP│ │ └─ NO → SAQ D│ └─ NO: Card-present only?│ ├─ Imprint/standalone dial → SAQ B│ ├─ Standalone IP terminals → SAQ B-IP│ ├─ P2PE validated solution → SAQ P2PE│ └─ Other → SAQ C or D└─ YES: → SAQ D (full assessment)
Security Controls Implementation
Requirement 3: Protect Stored Account Data
// PAN masking (display only first 6, last 4)public static class PanMasking{public static string Mask(string pan){if (string.IsNullOrEmpty(pan) || pan.Length < 13)return pan;// First 6 (BIN) + masked middle + last 4var first6 = pan[..6];var last4 = pan[^4..];var maskedLength = pan.Length - 10;return $"{first6}{new string('*', maskedLength)}{last4}";}// Example: 4111111111111111 → 411111******1111}// Strong cryptography for stored PAN (when storage required)public class PanEncryption{private readonly IKeyManagement _keyManager;public async Task<EncryptedPan> Encrypt(string pan, CancellationToken ct){// Use AES-256 minimumvar key = await _keyManager.GetCurrentKey("pan-encryption", ct);using var aes = Aes.Create();aes.Key = key.KeyMaterial;aes.GenerateIV();using var encryptor = aes.CreateEncryptor();var plainBytes = Encoding.UTF8.GetBytes(pan);var encryptedBytes = encryptor.TransformFinalBlock(plainBytes, 0, plainBytes.Length);return new EncryptedPan{EncryptedData = Convert.ToBase64String(encryptedBytes),KeyId = key.KeyId,IV = Convert.ToBase64String(aes.IV)};}}
Requirement 4: Encrypt Transmission
// TLS 1.2+ enforcementpublic static class TlsConfiguration{public static void ConfigureSecureDefaults(){// Disable older protocolsServicePointManager.SecurityProtocol =SecurityProtocolType.Tls12 |SecurityProtocolType.Tls13;}}// ASP.NET Core configurationpublic class Program{public static void Main(string[] args){var builder = WebApplication.CreateBuilder(args);builder.WebHost.ConfigureKestrel(options =>{options.ConfigureHttpsDefaults(https =>{https.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13;});});// ... rest of configuration}}
Requirement 8: Authentication
// Multi-factor authentication for CDE accesspublic class PciMfaPolicy{public bool RequiresMfa(string userId, string resourcePath){// MFA required for all CDE accessvar cdeResources = new[]{"/admin/payments","/api/transactions","/reports/cardholder"};return cdeResources.Any(r =>resourcePath.StartsWith(r, StringComparison.OrdinalIgnoreCase));}}// Password policy (PCI DSS 4.0)public class PciPasswordPolicy : IPasswordPolicy{public PasswordRequirements GetRequirements(){return new PasswordRequirements{MinimumLength = 12, // 4.0 increased from 7RequireComplexity = true, // Multiple character typesMaxAgeInDays = 90, // Force change every 90 daysHistoryCount = 4, // Can't reuse last 4LockoutThreshold = 10, // Lock after 10 failed attemptsLockoutDurationMinutes = 30,IdleTimeoutMinutes = 15 // Session timeout for CDE access};}}
Requirement 10: Logging and Monitoring
// PCI-compliant audit loggingpublic class PciAuditLogger{private readonly ILogger _logger;private readonly TimeProvider _timeProvider;public void LogCdeAccess(CdeAccessEvent accessEvent){// PCI requires: who, what, when, where, success/failurevar entry = new AuditEntry{Timestamp = _timeProvider.GetUtcNow(),UserId = accessEvent.UserId,UserName = accessEvent.UserName,EventType = accessEvent.EventType.ToString(),Resource = accessEvent.Resource,Action = accessEvent.Action,SourceIp = accessEvent.SourceIp,Success = accessEvent.Success,Details = accessEvent.Details};// Never log actual card data_logger.LogInformation("CDE_ACCESS: User={UserId} Action={Action} Resource={Resource} Success={Success} IP={SourceIp}",entry.UserId,entry.Action,entry.Resource,entry.Success,entry.SourceIp);// Retain logs for minimum 1 year// Immediately available for 3 months}public void LogSecurityEvent(SecurityEvent secEvent){// Security events to log:// - All access to CHD// - All actions by admin/root// - All invalid access attempts// - Creation/deletion of system objects// - Initialization of audit logs// - Stopping/pausing of audit logs}}
Network Segmentation
CDE Network Isolation
┌─────────────────────────────────────────────────────────────┐│ Corporate Network ││ ┌──────────────────────────────────────────────────────┐ ││ │ Cardholder Data Environment │ ││ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ ││ │ │ Payment │ │ Database │ │ Admin │ │ ││ │ │ Server │────│ Server │────│ Jumphost │ │ ││ │ └──────────┘ └──────────┘ └──────────┘ │ ││ │ │ │ │ ││ │ │ ← Firewall/ACLs → │ │ ││ └───────┼──────────────────────────────┼──────────────┘ ││ │ │ ││ ┌─────▼─────┐ ┌─────▼─────┐ ││ │ Web App │ │ Admin │ ││ │ (no CHD) │ │ Worksta. │ ││ └───────────┘ └───────────┘ │└─────────────────────────────────────────────────────────────┘
Firewall Rules for CDE
# Example firewall rulesCDE_Ingress:- Allow: Payment API (443) from Web Tier only- Allow: SSH (22) from Jumphost only- Allow: Database (5432) from Payment Server only- Deny: All otherCDE_Egress:- Allow: Payment Processor API (443)- Allow: NTP (123) to approved servers- Allow: Syslog (514) to SIEM- Deny: All other
PCI Compliance Checklist
Before Development
- [ ] Identify all payment flows
- [ ] Select scope reduction strategy
- [ ] Choose appropriate SAQ type
- [ ] Establish CDE boundaries
- [ ] Review vendor PCI compliance (AOCs)
Architecture & Design
- [ ] Document network segmentation
- [ ] Define encryption strategy (storage and transit)
- [ ] Design access control model
- [ ] Plan audit logging approach
- [ ] Ensure no CVV/PIN storage
Development
- [ ] Never log card data
- [ ] Implement TLS 1.2+ only
- [ ] Apply PAN masking for display
- [ ] Enforce MFA for CDE access
- [ ] Follow secure coding (Req 6)
Testing & Assessment
- [ ] Vulnerability scanning (internal/external quarterly)
- [ ] Penetration testing (annual)
- [ ] Segmentation testing (if segmented)
- [ ] Application security testing
Cross-References
- Security Frameworks:
security-frameworksfor control mapping - Data Classification:
data-classificationfor CHD handling - License Compliance:
license-compliancefor payment SDK terms