pci-dss-compliance

What this skill does

# PCI DSS Compliance Planning

Comprehensive guidance for Payment Card Industry Data Security Standard compliance before development begins.

## When to Use This Skill

- Building e-commerce or payment processing systems
- Integrating with payment gateways or processors
- Designing scope reduction strategies (tokenization, P2PE)
- Selecting appropriate SAQ for your business
- Preparing for PCI DSS assessments

## PCI DSS Fundamentals

### Cardholder Data Elements

| Data Element | Description | Storage Permitted? | Protection Required |
|--------------|-------------|-------------------|---------------------|
| **PAN** | Primary Account Number (16 digits) | Yes, if protected | Render unreadable |
| **Cardholder Name** | Name on card | Yes | Protect per requirement |
| **Service Code** | 3-4 digit code | Yes | Protect per requirement |
| **Expiration Date** | MM/YY | Yes | Protect per requirement |
| **CVV/CVC** | Card verification value | **NEVER** after auth | N/A - never store |
| **PIN/PIN Block** | Personal identification | **NEVER** after auth | N/A - never store |
| **Full Track Data** | Magnetic stripe data | **NEVER** after auth | N/A - never store |

### The 12 Requirements (PCI DSS 4.0)

```text
Goal 1: Build and Maintain a Secure Network and Systems
  1. Install and maintain network security controls
  2. Apply secure configurations to all system components

Goal 2: Protect Account Data
  3. Protect stored account data
  4. Protect cardholder data with strong cryptography during transmission

Goal 3: Maintain a Vulnerability Management Program
  5. Protect all systems and networks from malicious software
  6. Develop and maintain secure systems and software

Goal 4: Implement Strong Access Control Measures
  7. Restrict access to cardholder data by business need-to-know
  8. Identify users and authenticate access to system components
  9. Restrict physical access to cardholder data

Goal 5: Regularly Monitor and Test Networks
  10. Log and monitor all access to system components and cardholder data
  11. Test security of systems and networks regularly

Goal 6: Maintain an Information Security Policy
  12. Support information security with organizational policies and programs
```

## Scope Reduction Strategies

### Understanding PCI Scope

**In Scope:** Any system that stores, processes, or transmits cardholder data, OR connects to systems that do.

**Scope Reduction Goal:** Minimize systems handling raw cardholder data.

### Strategy 1: Tokenization

Replace PAN with non-sensitive token; processor stores actual card data.

```csharp
// Client-side tokenization flow
public class PaymentTokenization
{
    private readonly IPaymentGateway _gateway;

    public async Task<PaymentResult> ProcessPayment(
        string clientToken, // Token created in browser via gateway's JS
        decimal amount,
        string currency,
        CancellationToken ct)
    {
        // Server never sees raw card data - only token
        var request = new ChargeRequest
        {
            Token = clientToken,
            Amount = amount,
            Currency = currency,
            MerchantReference = Guid.NewGuid().ToString()
        };

        // Token is exchanged for payment at gateway
        var result = await _gateway.Charge(request, ct);

        // Store only the transaction reference, never card data
        return new PaymentResult
        {
            TransactionId = result.TransactionId,
            Status = result.Status,
            // Store token for recurring payments (if vaulted)
            VaultToken = result.VaultToken
        };
    }
}

// Scope: Only gateway SDK is in scope, not your entire application
```

### Strategy 2: Hosted Payment Page (Redirect)

Customer enters card data on processor's page; you never handle card data.

```csharp
public class HostedPaymentFlow
{
    private readonly IHostedPaymentProvider _provider;

    public async Task<string> CreatePaymentSession(
        Order order,
        CancellationToken ct)
    {
        var session = await _provider.CreateSession(new SessionRequest
        {
            Amount = order.Total,
            Currency = order.Currency,
            SuccessUrl = $"https://example.com/payment/success?order={order.Id}",
            CancelUrl = $"https://example.com/payment/cancel?order={order.Id}",
            WebhookUrl = "https://example.com/api/payment-webhook",
            Metadata = new Dictionary<string, string>
            {
                ["order_id"] = order.Id.ToString()
            }
        }, ct);

        // Redirect customer to processor's hosted page
        return session.RedirectUrl;
    }

    // Webhook receives payment confirmation - no card data
    public async Task HandleWebhook(PaymentWebhook webhook, CancellationToken ct)
    {
        // Verify webhook signature
        if (!_provider.VerifySignature(webhook))
            throw new SecurityException("Invalid webhook signature");

        // Update order status
        var orderId = Guid.Parse(webhook.Metadata["order_id"]);
        await _orderService.MarkPaid(orderId, webhook.TransactionId, ct);
    }
}
```

### Strategy 3: iFrame/Embedded Fields

Card fields are hosted by processor but appear on your page.

```html
<!-- Stripe Elements example - fields hosted by Stripe -->
<form id="payment-form">
    <div id="card-element">
        <!-- Stripe injects secure card input here -->
    </div>
    <button type="submit">Pay</button>
</form>

<script>
// Card data never touches your server
const stripe = Stripe('pk_live_xxx');
const elements = stripe.elements();
const cardElement = elements.create('card');
cardElement.mount('#card-element');

form.addEventListener('submit', async (e) => {
    e.preventDefault();
    // Token created client-side, sent to your server
    const {token} = await stripe.createToken(cardElement);
    // Only token goes to your server
    await fetch('/api/payment', {
        method: 'POST',
        body: JSON.stringify({ token: token.id })
    });
});
</script>
```

### Strategy 4: Point-to-Point Encryption (P2PE)

Hardware encrypts card data at swipe; decryption only at processor.

```text
Card Swipe → P2PE Terminal → Encrypted → Your Systems → Processor
                                        (can't decrypt)

Benefits:
- Your systems handle encrypted data only
- Dramatically reduced scope
- Requires P2PE validated solution
```

### Scope Reduction Comparison

| Strategy | Your PCI Scope | SAQ Type | Complexity |
|----------|---------------|----------|------------|
| Store raw cards | Full environment | D | Very High |
| Tokenization (API) | Token handling systems | A-EP or D | Medium |
| iFrame/Hosted Fields | Minimal (web page) | A or A-EP | Low |
| Redirect to Processor | None (referrer only) | A | Very Low |
| P2PE Hardware | Terminal + network | P2PE | Low |

## SAQ Selection Guide

### SAQ Types Overview

| SAQ | Applies To | Requirements | Questions |
|-----|------------|--------------|-----------|
| **A** | E-commerce, all card functions outsourced | No CHD on your systems | ~24 |
| **A-EP** | E-commerce, website impacts card security | iFrame/JS approach | ~191 |
| **B** | Imprint/standalone dial terminals only | No electronic storage | ~41 |
| **B-IP** | Standalone IP-connected terminals | No electronic storage | ~82 |
| **C** | Payment app on internet-connected systems | No electronic storage | ~160 |
| **C-VT** | Virtual terminal, no electronic storage | Web-based, no storage | ~79 |
| **D** | All other merchants | Full requirements | ~329 |
| **D (SP)** | Service providers | Full requirements | ~400+ |
| **P2PE** | Using validated P2PE solution | Terminal + P2PE | ~33 |

### Decision Tree

```text
Do you store/process/transmit CHD electronically?
├─ NO: Are you e-commerce only?
│   ├─ YES: All card functions outsourced?
│   │   ├─ YES → SAQ A
│   │   └─ NO: Website controls redirect/iFrame?
│   │       ├─ YES → SAQ A-EP
│   │       └─ NO → SAQ D
│   └─ NO: Card-present only?