Skip to main content

PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) v4.0 is the global security standard for any organization that stores, processes, or transmits cardholder data (CHD) or sensitive authentication data. Compliance is required by Visa, Mastercard, American Express, Discover, and other card brands.

Infracast ships 78 automated rules mapped to all 12 PCI DSS requirements, with particular depth in network segmentation, firewall auditing, and encryption validation.

PCI DSS v4.0 Overview​

PCI DSS v4.0 (released March 2022, mandatory since March 2024) introduced several new requirements around multi-factor authentication, targeted risk analysis, and customized implementation options.

The 12 Requirements​

ReqTitleInfracast Rules
1Install and Maintain Network Security Controls12
2Apply Secure Configurations to All System Components9
3Protect Stored Account Data8
4Protect Cardholder Data with Strong Cryptography During Transmission7
5Protect All Systems and Networks from Malicious Software5
6Develop and Maintain Secure Systems and Software6
7Restrict Access to System Components and Cardholder Data6
8Identify Users and Authenticate Access to System Components8
9Restrict Physical Access to Cardholder Data0 (attestation)
10Log and Monitor All Access to System Components and CHD7
11Test Security of Systems and Networks Regularly5
12Support Information Security with Organizational Policies5

Network Segmentation Validation​

PCI DSS Requirement 1 mandates strict network segmentation between the Cardholder Data Environment (CDE) and other networks. Infracast validates this automatically using the infrastructure graph:

Security Group Auditing​

// Finding: PCI-REQ1-SSH-FROM-INTERNET
{
  "rule_id": "PCI-REQ1-SSH-FROM-INTERNET",
  "control_id": "PCI-DSS v4.0 Req 1.3.2",
  "severity": "CRITICAL",
  "title": "Security group allows SSH (port 22) from 0.0.0.0/0",
  "description": "Security group 'sg-0abc123' allows unrestricted inbound SSH from the internet.",
  "remediation": "Restrict SSH access to known admin CIDR ranges or a bastion host."
}

CDE Boundary Mapping​

Use Infracast's application layer to define your CDE boundary, then scope all PCI checks to in-scope systems:

# Define CDE as an application
POST /api/v1/tenants/{tenantID}/applications
{
  "name": "Cardholder Data Environment",
  "tags": ["pci-in-scope", "cde"]
}

# Run the path tracer to validate segmentation
POST /api/v1/tenants/{tenantID}/pathtracer/trace
{
  "source_node_id": "aws:us-east-1:aws.ec2.instance:dev-server",
  "destination_cidr": "10.1.2.0/24",
  "port": 5432,
  "protocol": "tcp"
}

If the trace finds a reachable path from out-of-scope systems to the CDE, this is flagged as a finding.

Firewall Rule Auditing​

Infracast evaluates every security group, network ACL, and firewall rule in your infrastructure graph against PCI requirements:

RuleRequirementWhat's Checked
PCI-REQ1-NO-ANY-ANY1.3.1Deny-all default, allow by exception
PCI-REQ1-SSH-RESTRICTED1.3.2SSH not allowed from 0.0.0.0/0
PCI-REQ1-RDP-RESTRICTED1.3.2RDP (3389) not open to internet
PCI-REQ1-DEFAULT-SG-CLEAN1.3.3Default security group has no traffic rules
PCI-REQ1-NACL-RESTRICT1.3.4NACLs restrict inbound traffic

Sample Findings Query​

# Get all PCI DSS firewall-related findings
curl -H "Authorization: Bearer $TOKEN" \
  "$API_URL/api/v1/tenants/$TENANT/findings?framework=pci-dss&control_family=req1"

Encryption Checks​

PCI DSS Requirements 3 and 4 mandate strong cryptography for stored and transmitted cardholder data:

Encryption at Rest (Req 3.5)​

RuleWhat's Checked
PCI-REQ3-EBS-ENCRYPTIONEBS volumes must be encrypted
PCI-REQ3-RDS-ENCRYPTIONRDS instances must have encryption at rest
PCI-REQ3-S3-ENCRYPTIONS3 buckets must use SSE-S3 or SSE-KMS
PCI-REQ3-S3-PUBLIC-BLOCKS3 bucket public access must be blocked
PCI-REQ3-SECRETS-NO-PLAINTEXTNo credentials in EC2 user data or environment vars

Encryption in Transit (Req 4.2)​

RuleWhat's Checked
PCI-REQ4-ELB-HTTPS-ONLYLoad balancers must enforce HTTPS
PCI-REQ4-S3-TLS-ONLYS3 buckets must deny non-TLS requests
PCI-REQ4-CLOUDFRONT-HTTPSCloudFront distributions must enforce HTTPS
PCI-REQ4-RDS-TLSRDS must require TLS connections
PCI-REQ4-NO-WEAK-CIPHERSNo TLS 1.0/1.1 or weak cipher suites

Example Finding​

{
  "rule_id": "PCI-REQ3-EBS-ENCRYPTION",
  "control_id": "PCI-DSS v4.0 Req 3.5.1",
  "severity": "HIGH",
  "title": "EBS volume not encrypted at rest",
  "description": "EBS volume 'vol-0abc123def' attached to 'prod-web-01' is not encrypted.",
  "remediation": "Enable EBS encryption. Create an encrypted snapshot and restore, or use encrypted replacement volume."
}

Terraform fix:

resource "aws_ebs_volume" "data" {
  availability_zone = "us-east-1a"
  size              = 100
  encrypted         = true        # Add this
  kms_key_id        = aws_kms_key.ebs.arn
}

Access Control (Req 7 & 8)​

PCI DSS v4.0 now requires MFA for all access to the CDE, not just remote access:

RuleRequirementCheck
PCI-REQ8-ROOT-MFA8.4.1Root/admin accounts must have MFA
PCI-REQ8-ALL-USER-MFA8.4.2All users must have MFA enabled
PCI-REQ8-PASSWORD-LENGTH8.3.6Password minimum length ≥ 12 characters
PCI-REQ8-ACCOUNT-LOCKOUT8.3.4Account lockout after 6 failed attempts
PCI-REQ7-LEAST-PRIVILEGE7.2.1IAM policies follow least privilege

Compliance Reporting​

Generate PCI DSS reports for your QSA (Qualified Security Assessor):

# Generate PCI DSS compliance report
POST /api/v1/tenants/{tenantID}/reports/generate
{
  "type": "framework",
  "framework": "pci-dss",
  "format": "pdf",
  "options": {
    "include_evidence": true,
    "include_remediation": true
  }
}

Report of Compliance (RoC) Support​

While Infracast does not generate a full RoC (which requires QSA sign-off), the generated reports include:

  • Control-by-control status with pass/fail/exempt
  • Evidence artifacts with timestamps
  • Remediation recommendations
  • Risk acceptance documentation
  • Historical trend data
tip

Schedule quarterly PCI DSS reports to track remediation progress and demonstrate continuous compliance to your QSA.

PCI Compliance Score​

GET /api/v1/tenants/{tenantID}/compliance/summary?framework=pci-dss

{
  "framework": "pci-dss",
  "version": "4.0",
  "score": 88,
  "requirements": {
    "req1": { "score": 83, "rules": 12, "passing": 10 },
    "req2": { "score": 89, "rules": 9, "passing": 8 },
    "req3": { "score": 87, "rules": 8, "passing": 7 },
    "req4": { "score": 100, "rules": 7, "passing": 7 },
    "req8": { "score": 75, "rules": 8, "passing": 6 }
  }
}

PCI DSS SAQ Generator​

Infracast auto-generates a PCI DSS v4.0 Self-Assessment Questionnaire (SAQ) with your merchant and infrastructure details pre-filled.

SAQ type is auto-detected from infrastructure topology:

  • SAQ A — Card-not-present merchants, no cardholder data on systems; fully outsourced
  • SAQ B — Imprint-only or standalone dial-out terminals
  • SAQ C — Merchants with payment application systems connected to the internet
  • SAQ D — All other merchants (catches everything not covered above)

The auto-detection logic checks for: internet-facing nodes in the CDE subnet, direct card processing components, and segmentation evidence in the topology graph.

What’s included:

  • Merchant information (from questionnaire)
  • Cardholder Data Environment (CDE) description (auto-populated from scoped nodes)
  • All applicable SAQ control sections with pass/fail per discovered configuration
  • Network segmentation evidence summary
  • Compensating controls worksheet (where applicable)

Generate via UI: Documents → Generate → PCI DSS SAQ
DocType: pci_saq

Required questionnaire fields: Merchant legal name, CDE description, SAQ type confirmation (or accept auto-detected), segmentation attestation. (Template: pci_scope)

Next Steps​