pci-dss-compliance

1# PCI DSS Compliance
2 
3Implement PCI DSS v4.0 requirements for protecting cardholder data across the Cardholder Data Environment (CDE), including network segmentation, encryption, access controls, and ongoing testing.
4 
5## When to Use
6 
7- Processing, storing, or transmitting payment card data
8- Scoping the Cardholder Data Environment for PCI assessment
9- Selecting the appropriate Self-Assessment Questionnaire (SAQ)
10- Implementing network segmentation to reduce CDE scope
11- Preparing for QSA assessment or ASV scanning
12 
13## SAQ Types and Applicability
14 
15```yaml
16saq_types:
17  SAQ_A:
18    description: "Card-not-present merchants using fully outsourced payment"
19    applies_when:
20      - All payment processing fully outsourced to PCI-compliant third party
21      - No electronic storage, processing, or transmission of cardholder data
22      - Only payment page redirects or iframes from compliant provider
23    requirements: ~22 questions
24 
25  SAQ_A_EP:
26    description: "E-commerce merchants with website that affects payment security"
27    applies_when:
28      - E-commerce channel only
29      - Website controls redirect to or loads payment page from third party
30      - No direct processing but website could affect transaction security
31    requirements: ~191 questions
32 
33  SAQ_B:
34    description: "Merchants with only imprint machines or standalone terminals"
35    applies_when:
36      - Only standalone POS terminals (dial-out or IP connected)
37      - No electronic cardholder data storage
38…