pci-dss-specialist

What this skill does

# PCI-DSS v4.0 Specialist

Implement, assess, and maintain compliance with the Payment Card Industry Data Security Standard version 4.0 — the global standard for protecting cardholder data in payment processing environments.

---

## Table of Contents

- [Trigger Phrases](#trigger-phrases)
- [Quick Start](#quick-start)
- [Tools](#tools)
- [PCI DSS v4.0 Overview](#pci-dss-v40-overview)
- [12 Requirements Deep-Dive](#12-requirements-deep-dive)
- [v4.0 Changes from v3.2.1](#v40-changes-from-v321)
- [CDE Scoping](#cardholder-data-environment-scoping)
- [SAQ Types and Selection Guide](#saq-types-and-selection-guide)
- [Assessment Types](#assessment-types)
- [Merchant and Service Provider Levels](#merchant-and-service-provider-levels)
- [Infrastructure Controls](#infrastructure-controls)
- [PCI DSS Compliance Roadmap](#pci-dss-compliance-roadmap)
- [Reference Guides](#reference-guides)
- [Validation Checkpoints](#validation-checkpoints)

---

## Trigger Phrases

Use this skill when you hear:
- "PCI DSS"
- "payment card security"
- "cardholder data"
- "PCI compliance"
- "payment security"
- "PCI assessment"
- "SAQ"
- "ROC"
- "QSA"
- "credit card security"
- "payment processing security"
- "tokenization"
- "CDE scoping"
- "merchant level compliance"

---

## Quick Start

### Check PCI Compliance Status

```bash
python scripts/pci_compliance_checker.py --input controls.json --output compliance_report.json
```

### Determine SAQ Type

```bash
python scripts/pci_scope_analyzer.py --input business_model.json --output scope_report.json
```

### Generate Compliance Gap Report (Markdown)

```bash
python scripts/pci_compliance_checker.py --input controls.json --format markdown --output gap_report.md
```

### Analyze CDE Scope

```bash
python scripts/pci_scope_analyzer.py --input business_model.json --format markdown --output scope_analysis.md
```

---

## Tools

### pci_compliance_checker.py

Comprehensive PCI DSS v4.0 compliance assessment engine.

**Capabilities:**
- Checks against all 12 PCI DSS requirements
- Validates cardholder data environment scope
- Assesses technical controls (encryption, access, logging)
- Scores compliance per requirement (0-100)
- Identifies gaps with remediation priorities
- Generates JSON or Markdown output

**Usage:**

```bash
# Full compliance check
python scripts/pci_compliance_checker.py \
  --input controls.json \
  --output report.json

# Markdown report for stakeholders
python scripts/pci_compliance_checker.py \
  --input controls.json \
  --format markdown \
  --output compliance_report.md

# Check specific requirements only
python scripts/pci_compliance_checker.py \
  --input controls.json \
  --requirements 3,4,7,8 \
  --output data_security_report.json
```

**Input Format (controls.json):**

```json
{
  "organization": "Acme Payments",
  "assessment_date": "2026-03-09",
  "merchant_level": 2,
  "requirements": {
    "1": {
      "network_segmentation": true,
      "firewall_rules_documented": true,
      "waf_deployed": true,
      "inbound_traffic_restricted": true,
      "outbound_traffic_restricted": false,
      "wireless_networks_segmented": true,
      "notes": "Outbound filtering planned for Q2"
    },
    "3": {
      "pan_storage_minimized": true,
      "pan_masked_when_displayed": true,
      "pan_encrypted_at_rest": true,
      "encryption_algorithm": "AES-256",
      "key_management_procedures": true,
      "tokenization_implemented": true,
      "sad_not_stored_after_auth": true,
      "notes": "Tokenization covers 95% of stored PANs"
    }
  }
}
```

### pci_scope_analyzer.py

CDE scoping and SAQ type determination engine.

**Capabilities:**
- Determines appropriate SAQ type based on business model
- Maps cardholder data environment boundaries
- Identifies connected systems and security-impacting systems
- Generates scoping worksheet with system classifications
- Recommends scope reduction strategies

**Usage:**

```bash
# Determine SAQ type and CDE scope
python scripts/pci_scope_analyzer.py \
  --input business_model.json \
  --output scope_report.json

# Markdown scoping worksheet
python scripts/pci_scope_analyzer.py \
  --input business_model.json \
  --format markdown \
  --output scoping_worksheet.md
```

**Input Format (business_model.json):**

```json
{
  "organization": "Acme Payments",
  "business_type": "e-commerce",
  "payment_channels": ["web", "mobile_app"],
  "card_present": false,
  "card_not_present": true,
  "stores_pan": false,
  "processes_pan": false,
  "transmits_pan": false,
  "payment_processor": "Stripe",
  "uses_iframe_redirect": true,
  "uses_p2pe": false,
  "annual_transactions": 500000,
  "card_brands": ["visa", "mastercard", "amex"],
  "systems": [
    {
      "name": "web-frontend",
      "type": "web_server",
      "handles_cardholder_data": false,
      "connected_to_cde": false,
      "security_impacting": true,
      "description": "Customer-facing e-commerce site with iframe payment"
    },
    {
      "name": "payment-api",
      "type": "application_server",
      "handles_cardholder_data": false,
      "connected_to_cde": true,
      "security_impacting": true,
      "description": "API server that communicates with Stripe"
    }
  ]
}
```

---

## PCI DSS v4.0 Overview

### What Is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard developed by the PCI Security Standards Council (PCI SSC), founded by American Express, Discover, JCB, Mastercard, and Visa. It applies to all entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD).

### PCI DSS v4.0 Timeline

| Date | Milestone |
|------|-----------|
| March 2022 | PCI DSS v4.0 published |
| March 2024 | v3.2.1 retired; v4.0 is the only active version |
| March 31, 2025 | All future-dated requirements become mandatory |

**All organizations must now comply with the full PCI DSS v4.0 standard, including all previously future-dated requirements.**

### What Data Is Protected

**Cardholder Data (CHD):**
- Primary Account Number (PAN) — the credit/debit card number
- Cardholder Name (when stored with PAN)
- Service Code
- Expiration Date

**Sensitive Authentication Data (SAD):** Must NEVER be stored after authorization, even if encrypted.
- Full track data (magnetic stripe, chip)
- CVV/CVC/CAV2/CID (card verification codes)
- PIN and PIN block

---

## 12 Requirements Deep-Dive

### Requirement 1: Install and Maintain Network Security Controls

**Objective:** Protect the cardholder data environment through network security controls.

**Key Sub-Requirements:**
- **1.2.1** — Network security controls (NSCs) are configured and maintained
- **1.2.5** — All services, protocols, and ports allowed are identified and approved
- **1.2.8** — NSC configuration files are secured and synchronized
- **1.3.1** — Inbound traffic to the CDE is restricted to only necessary traffic
- **1.3.2** — Outbound traffic from the CDE is restricted to only necessary traffic
- **1.4.1** — NSCs are implemented between trusted and untrusted networks
- **1.4.5** — Disclosure of internal IP addresses is prevented
- **1.5.1** — Security controls on all computing devices connecting via untrusted networks

**Implementation Guidance:**
- Deploy next-generation firewalls (NGFW) at CDE boundaries
- Implement Web Application Firewalls (WAF) for web-facing payment applications
- Use network segmentation to isolate CDE from corporate network
- Restrict inbound to CDE: only necessary ports/protocols from known sources
- Restrict outbound from CDE: only approved destinations (payment processor, updates)
- Document all firewall rules with business justification
- Review firewall rules at least every 6 months
- Implement micro-segmentation where possible

---

### Requirement 2: Apply Secure Configurations to All System Components

**Objective:** Ensure all systems are configured securely with no unnecessary default settings.

**Key Sub-Requirements:**
- **2.2.1** — Configuration