PCI DSS v4.0.1

المقارنات

المتطلبات

تُعرض معرّفات المتطلبات وعناوينها كما تنشرها كل جهة معيارية، باللغة الإنجليزية.

متطلبات PCI DSS v4.0.1

ID	المتطلب	الموضوعات	مُطابَق في
Requirement 1: Install and maintain network security controls · 19
1.1.1	Network security policies documented and kept current	—	0
1.1.2	Roles for network security controls assigned	—	0
1.2.1	Configuration standards for network security controls	جدار الحماية / تجزئة الشبكة	9 من 13
1.2.2	Network connection changes go through change control	—	لا شيء
1.2.3	Accurate network diagram maintained	جدار الحماية / تجزئة الشبكة	9 من 13
1.2.4	Accurate account-data flow diagram maintained	—	0
1.2.5	Allowed services, protocols and ports approved	—	لا شيء
1.2.6	Security features defined for insecure services	—	لا شيء
1.2.7	Network security control rules reviewed every six months	—	لا شيء
1.2.8	Network security control configuration files secured	—	لا شيء
1.3.1	Inbound traffic to the CDE restricted	جدار الحماية / تجزئة الشبكة	9 من 13
1.3.2	Outbound traffic from the CDE restricted	—	لا شيء
1.3.3	Network controls between wireless networks and the CDE	—	لا شيء
1.4.1	Network controls between trusted and untrusted networks	جدار الحماية / تجزئة الشبكة	9 من 13
1.4.2	Inbound traffic from untrusted networks restricted	—	لا شيء
1.4.3	Anti-spoofing measures in place	—	لا شيء
1.4.4	Stored cardholder data not reachable from untrusted networks	—	لا شيء
1.4.5	Internal IP addresses and routing not disclosed	—	لا شيء
1.5.1	Controls on devices connecting to untrusted networks and the CDE	—	لا شيء
Requirement 2: Apply secure configurations to all system components · 11
2.1.1	Secure configuration policies documented and kept current	—	0
2.1.2	Roles for secure configuration assigned	—	0
2.2.1	System configuration standards developed and maintained	الإعدادات الآمنة	9 من 13
2.2.2	Vendor default accounts managed or removed	الإعدادات الآمنة	9 من 13
2.2.3	Functions with different security levels kept apart	—	لا شيء
2.2.4	Only necessary services and functions enabled	—	لا شيء
2.2.5	Insecure services justified and secured	—	لا شيء
2.2.6	System security parameters set to prevent misuse	—	لا شيء
2.2.7	Non-console administrative access encrypted	—	لا شيء
2.3.1	Wireless vendor defaults changed	—	0
2.3.2	Wireless keys changed when key holders leave	—	لا شيء
Requirement 3: Protect stored account data · 29
3.1.1	Stored account data policies documented and kept current	—	0
3.1.2	Roles for protecting stored account data assigned	—	0
3.2.1	Account data storage minimised, with retention and disposal	حماية البيانات	11 من 13
3.3.1	Sensitive authentication data not kept after authorisation	حماية البيانات	11 من 13
3.3.1.1	Full track data not kept after authorisation	—	لا شيء
3.3.1.2	Card verification code not kept after authorisation	—	لا شيء
3.3.1.3	PIN and PIN block not kept after authorisation	—	لا شيء
3.3.2	Sensitive authentication data encrypted before authorisation	—	لا شيء
3.3.3	Issuer storage of sensitive authentication data limited and protected	—	لا شيء
3.4.1	PAN masked when displayed	حماية البيانات	11 من 13
3.4.2	PAN copying prevented over remote-access technologies	DLP	7 من 13
3.5.1	PAN rendered unreadable wherever stored	التشفير	10 من 13
3.5.1.1	Hashes of PAN are keyed cryptographic hashes	—	لا شيء
3.5.1.2	Disk-level encryption used only where it suffices	—	لا شيء
3.5.1.3	Disk encryption access managed separately from OS access	—	0
3.6.1	Procedures protect keys that secure stored account data	التشفير	10 من 13
3.6.1.1	Service providers document their cryptographic architecture	—	0
3.6.1.2	Secret and private keys stored in approved forms	—	0
3.6.1.3	Cleartext key components accessible to fewest custodians	—	0
3.6.1.4	Keys stored in the fewest possible locations	—	0
3.7.1	Key management: strong key generation	التشفير	10 من 13
3.7.2	Key management: secure key distribution	—	لا شيء
3.7.3	Key management: secure key storage	—	لا شيء
3.7.4	Key management: key changes at end of cryptoperiod	التشفير	10 من 13
3.7.5	Key management: retiring weakened or compromised keys	—	لا شيء
3.7.6	Key management: split knowledge and dual control	—	لا شيء
3.7.7	Key management: preventing unauthorised key substitution	—	لا شيء
3.7.8	Key custodians formally acknowledge their responsibilities	—	لا شيء
3.7.9	Service providers give customers key-handling guidance	—	لا شيء
Requirement 4: Protect cardholder data with strong cryptography during transmission · 6
4.1.1	Data-in-transit policies documented and kept current	—	0
4.1.2	Roles for protecting data in transit assigned	—	0
4.2.1	Strong cryptography for PAN over open, public networks	التشفير	10 من 13
4.2.1.1	Inventory of trusted keys and certificates kept	التشفير	10 من 13
4.2.1.2	Strong cryptography on wireless networks carrying PAN	—	لا شيء
4.2.2	PAN secured when sent by end-user messaging	—	لا شيء
Requirement 5: Protect all systems and networks from malicious software · 13
5.1.1	Anti-malware policies documented and kept current	—	0
5.1.2	Roles for malware protection assigned	—	0
5.2.1	Anti-malware deployed on system components	حماية نقاط النهاية	10 من 13
5.2.2	Anti-malware detects, removes or contains known malware	حماية نقاط النهاية	10 من 13
5.2.3	Systems without anti-malware periodically re-evaluated	—	0
5.2.3.1	Re-evaluation frequency set by targeted risk analysis	—	0
5.3.1	Anti-malware kept up to date	—	لا شيء
5.3.2	Periodic scans or continuous behavioural analysis	حماية نقاط النهاية	10 من 13
5.3.2.1	Scan frequency set by targeted risk analysis	—	0
5.3.3	Removable media scanned or analysed	—	لا شيء
5.3.4	Anti-malware audit logs enabled and retained	—	لا شيء
5.3.5	Users cannot disable or alter anti-malware	—	لا شيء
5.4.1	Mechanisms to detect and protect against phishing	أمن البريد الإلكتروني	8 من 13
Requirement 6: Develop and maintain secure systems and software · 19
6.1.1	Secure systems and software policies documented	—	0
6.1.2	Roles for secure systems and software assigned	—	0
6.2.1	Bespoke and custom software developed securely	التطوير الآمن	8 من 13
6.2.2	Developers trained in secure software development	التطوير الآمن	8 من 13
6.2.3	Custom code reviewed before release	التطوير الآمن, أمن واجهات برمجة التطبيقات	8 من 13
6.2.3.1	Manual code reviews approved by someone else	—	0
6.2.4	Coding techniques prevent common software attacks	أمن واجهات برمجة التطبيقات	4 من 13
6.3.1	Vulnerabilities identified and risk-ranked	إدارة الثغرات, استخبارات التهديدات, إدارة الرقع	13 من 13
6.3.2	Inventory of custom software and its components	مخاطر سلسلة التوريد, إدارة الأصول	13 من 13
6.3.3	Security patches installed promptly	إدارة الرقع	10 من 13
6.4.1	Public web applications protected against attacks	أمن تطبيقات الويب	6 من 13
6.4.2	Automated solution blocks attacks on public web apps	WAF	5 من 13
6.4.3	Payment page scripts authorised and integrity-checked	أمن تطبيقات الويب	6 من 13
6.5.1	Production changes follow change control procedures	—	لا شيء
6.5.2	PCI DSS requirements re-confirmed after significant changes	—	لا شيء
6.5.3	Pre-production environments separated from production	—	لا شيء
6.5.4	Duties separated between production and pre-production	—	لا شيء
6.5.5	Live PANs not used in pre-production	—	لا شيء
6.5.6	Test data and accounts removed before go-live	—	لا شيء
Requirement 7: Restrict access to system components and cardholder data by business need to know · 12
7.1.1	Access restriction policies documented and kept current	—	0
7.1.2	Roles for access restriction assigned	—	0
7.2.1	Access control model defined	التحكم في الوصول, الثقة المعدومة	11 من 13
7.2.2	Access assigned by job function and least privilege	التحكم في الوصول, الوصول المميز	12 من 13
7.2.3	Privileges approved by authorised personnel	—	لا شيء
7.2.4	User accounts and privileges reviewed every six months	التحكم في الوصول	11 من 13
7.2.5	System and application accounts least privilege	—	لا شيء
7.2.5.1	System and application account access periodically reviewed	—	0
7.2.6	Access to cardholder data repositories restricted	—	لا شيء
7.3.1	Access control system restricts access by need	—	لا شيء
7.3.2	Access control system enforces assigned permissions	—	لا شيء
7.3.3	Access control system set to deny by default	—	لا شيء
Requirement 8: Identify users and authenticate access to system components · 29
8.1.1	Identification and authentication policies documented	—	0
8.1.2	Roles for identification and authentication assigned	—	0
8.2.1	Every user has a unique ID	التحكم في الوصول	11 من 13
8.2.2	Shared or generic accounts only by documented exception	—	0
8.2.3	Service providers use unique credentials per customer	—	لا شيء
8.2.4	User ID changes authorised and controlled	—	لا شيء
8.2.5	Access revoked immediately on termination	—	0
8.2.6	Inactive user accounts disabled within 90 days	—	0
8.2.7	Third-party remote access accounts enabled only when needed	—	لا شيء
8.2.8	Re-authentication after 15 minutes idle	—	0
8.3.1	User and admin access requires an authentication factor	الثقة المعدومة	7 من 13
8.3.2	Authentication factors unreadable in transit and storage	—	لا شيء
8.3.3	Identity verified before changing authentication factors	—	لا شيء
8.3.4	Account lockout after repeated failed attempts	—	لا شيء
8.3.5	First-use and reset passwords unique and changed	—	0
8.3.6	Minimum password length and complexity	—	0
8.3.7	Recent passwords cannot be reused	—	0
8.3.8	Authentication guidance communicated to users	—	0
8.3.9	Password-only access: change every 90 days or analyse risk	—	0
8.3.10	Service providers give customers password guidance	—	0
8.3.10.1	Service provider customer passwords: rotation or analysis	—	0
8.3.11	Tokens, smart cards and certificates assigned to individuals	—	لا شيء
8.4.1	MFA for non-console administrative access to the CDE	المصادقة متعددة العناصر	10 من 13
8.4.2	MFA for all access into the CDE	المصادقة متعددة العناصر	10 من 13
8.4.3	MFA for remote network access	المصادقة متعددة العناصر	10 من 13
8.5.1	MFA systems configured to resist misuse	المصادقة متعددة العناصر	10 من 13
8.6.1	Interactive use of system accounts managed	—	لا شيء
8.6.2	No hard-coded passwords for system accounts	—	0
8.6.3	System account passwords protected and changed	—	0
Requirement 9: Restrict physical access to cardholder data · 27
9.1.1	Physical security policies documented and kept current	—	0
9.1.2	Roles for physical security assigned	—	0
9.2.1	Facility entry controls restrict CDE access	الأمن المادي	8 من 13
9.2.1.1	Access to sensitive areas monitored by camera or access control	الأمن المادي	8 من 13
9.2.2	Publicly accessible network jacks restricted	—	لا شيء
9.2.3	Physical access to network hardware restricted	الأمن المادي	8 من 13
9.2.4	Consoles in sensitive areas locked when unattended	—	0
9.3.1	Personnel physical access authorised and managed	الأمن المادي	8 من 13
9.3.1.1	Sensitive-area access authorised and revoked promptly	الأمن المادي	8 من 13
9.3.2	Visitor access authorised, escorted and identifiable	الأمن المادي	8 من 13
9.3.3	Visitor badges returned or deactivated	—	لا شيء
9.3.4	Visitor log maintained and retained	—	لا شيء
9.4.1	Media with cardholder data physically secured	—	لا شيء
9.4.1.1	Offline backup media stored securely	النسخ الاحتياطي والاستعادة	11 من 13
9.4.1.2	Security of offline backup location reviewed annually	—	0
9.4.2	Media classified by data sensitivity	تصنيف البيانات	9 من 13
9.4.3	Media sent off site tracked and secured	—	لا شيء
9.4.4	Management approves media moved off site	—	لا شيء
9.4.5	Inventory logs of electronic media kept	—	لا شيء
9.4.5.1	Electronic media inventories at least annually	—	لا شيء
9.4.6	Hard-copy media destroyed when no longer needed	—	0
9.4.7	Electronic media destroyed or made unrecoverable	—	0
9.5.1	Card-reading (POI) devices protected from tampering	—	لا شيء
9.5.1.1	Inventory of POI devices kept	—	0
9.5.1.2	POI devices inspected for tampering	—	0
9.5.1.2.1	Inspection frequency set by targeted risk analysis	—	0
9.5.1.3	Staff trained to spot POI tampering	—	لا شيء
Requirement 10: Log and monitor all access to system components and cardholder data · 27
10.1.1	Logging and monitoring policies documented	—	0
10.1.2	Roles for logging and monitoring assigned	—	0
10.2.1	Audit logs enabled and active	التسجيل والتدقيق, التهديدات الداخلية	11 من 13
10.2.1.1	Logs capture user access to cardholder data	—	لا شيء
10.2.1.2	Logs capture administrative actions	—	لا شيء
10.2.1.3	Logs capture access to audit logs	—	لا شيء
10.2.1.4	Logs capture invalid access attempts	—	لا شيء
10.2.1.5	Logs capture credential and privilege changes	—	لا شيء
10.2.1.6	Logs capture starting, stopping or pausing logging	—	لا شيء
10.2.1.7	Logs capture system-level object changes	—	لا شيء
10.2.2	Log entries record who, what, when, where and outcome	—	0
10.3.1	Read access to logs limited to need	—	0
10.3.2	Logs protected from modification	التسجيل والتدقيق, الطب الشرعي الرقمي	10 من 13
10.3.3	Logs promptly backed up to a central server	—	0
10.3.4	File-integrity monitoring on logs	—	0
10.4.1	Security event and critical logs reviewed daily	المراقبة المستمرة, SIEM / SOC	10 من 13
10.4.1.1	Automated mechanisms for log review	اكتشاف الشذوذ	9 من 13
10.4.2	Other logs reviewed periodically	—	لا شيء
10.4.2.1	Review frequency set by targeted risk analysis	—	0
10.4.3	Exceptions and anomalies addressed	—	لا شيء
10.5.1	Audit logs retained 12 months, three immediately available	التسجيل والتدقيق	10 من 13
10.6.1	System clocks synchronised	التسجيل والتدقيق	10 من 13
10.6.2	Time configuration correct and consistent	—	لا شيء
10.6.3	Time settings protected from change	—	0
10.7.1	Service providers detect security control failures	—	0
10.7.2	Critical security control failures detected and reported	—	0
10.7.3	Security control failures responded to promptly	—	لا شيء
Requirement 11: Test security of systems and networks regularly · 21
11.1.1	Security testing policies documented and kept current	—	0
11.1.2	Roles for security testing assigned	—	0
11.2.1	Wireless access points detected and unauthorised ones handled	—	0
11.2.2	Inventory of authorised wireless access points	—	لا شيء
11.3.1	Internal vulnerability scans every three months	إدارة الثغرات	13 من 13
11.3.1.1	Lower-ranked vulnerabilities handled by risk analysis	—	0
11.3.1.2	Internal scans use authenticated scanning	—	لا شيء
11.3.1.3	Internal scans after significant changes	—	لا شيء
11.3.2	External ASV scans every three months	إدارة الثغرات	13 من 13
11.3.2.1	External scans after significant changes	—	لا شيء
11.4.1	Penetration testing methodology defined	—	لا شيء
11.4.2	Internal penetration test at least annually	—	لا شيء
11.4.3	External penetration test at least annually	—	لا شيء
11.4.4	Penetration test findings corrected and retested	—	0
11.4.5	Segmentation controls tested at least annually	—	لا شيء
11.4.6	Service providers test segmentation every six months	—	لا شيء
11.4.7	Multi-tenant providers support customer penetration tests	—	لا شيء
11.5.1	Intrusion detection or prevention on network traffic	كشف التسلل	9 من 13
11.5.1.1	Service providers detect covert malware communication	—	لا شيء
11.5.2	Change-detection on critical files	—	لا شيء
11.6.1	Payment page changes and tampering detected	—	0
Requirement 12: Support information security with organizational policies and programs · 37
12.1.1	Information security policy established and published	سياسة الحوكمة	9 من 13
12.1.2	Security policy reviewed at least annually	سياسة الحوكمة	9 من 13
12.1.3	Security roles and responsibilities defined	الأدوار والمسؤوليات	9 من 13
12.1.4	Executive responsibility for information security assigned	الأدوار والمسؤوليات	9 من 13
12.2.1	Acceptable use policies for end-user technologies	—	لا شيء
12.3.1	Targeted risk analysis for flexible-frequency requirements	إدارة المخاطر, تقييم المخاطر	10 من 13
12.3.2	Targeted risk analysis for customised approach	—	0
12.3.3	Cipher suites and protocols reviewed annually	—	0
12.3.4	Hardware and software technologies reviewed annually	—	0
12.4.1	Service providers: executive responsibility for PCI DSS compliance	—	لا شيء
12.4.2	Service providers: quarterly reviews of operational tasks	الامتثال	10 من 13
12.4.2.1	Service providers: quarterly review results documented	—	0
12.5.1	Inventory of in-scope system components	إدارة الأصول	13 من 13
12.5.2	PCI DSS scope confirmed annually and on change	بيئة الأعمال	5 من 13
12.5.2.1	Service providers confirm scope every six months	—	لا شيء
12.5.3	Service providers review scope after organisational change	—	0
12.6.1	Formal security awareness programme	التوعية والتدريب	10 من 13
12.6.2	Awareness programme reviewed annually	—	لا شيء
12.6.3	Awareness training on hire and at least annually	التوعية والتدريب	10 من 13
12.6.3.1	Training covers phishing and social engineering	—	لا شيء
12.6.3.2	Training covers acceptable use of technology	—	لا شيء
12.7.1	Personnel screened before hire	التهديدات الداخلية	8 من 13
12.8.1	List of third-party service providers kept	مخاطر سلسلة التوريد, أمن السحابة, إدارة مخاطر الموردين	12 من 13
12.8.2	Written agreements with service providers	إدارة مخاطر الموردين	10 من 13
12.8.3	Due diligence before engaging service providers	إدارة مخاطر الموردين	10 من 13
12.8.4	Service provider compliance monitored annually	إدارة مخاطر الموردين	10 من 13
12.8.5	Responsibilities split with each provider documented	أمن السحابة, إدارة مخاطر الموردين	12 من 13
12.9.1	Service providers acknowledge responsibilities to customers	—	0
12.9.2	Service providers support customer compliance requests	—	0
12.10.1	Incident response plan ready to activate	الاستجابة للحوادث, التخفيف, الإبلاغ, تخطيط الاستعادة, استمرارية الأعمال, التعافي من الكوارث	12 من 13
12.10.2	Incident response plan reviewed and tested annually	الاستجابة للحوادث	12 من 13
12.10.3	Incident response staff available around the clock	الاستجابة للحوادث	12 من 13
12.10.4	Incident response staff trained	الاستجابة للحوادث	12 من 13
12.10.4.1	Training frequency set by targeted risk analysis	—	0
12.10.5	Plan covers alerts from security monitoring	—	0
12.10.6	Plan updated from lessons learned and industry changes	الدروس المستفادة	9 من 13
12.10.7	Procedures for PAN found where it shouldn't be	—	0
Appendix A: additional requirements · 10
A1.1.1	Multi-tenant providers: separate provider and customer environments	—	لا شيء
A1.1.2	Multi-tenant providers: customers confined to their own environment	—	لا شيء
A1.1.3	Multi-tenant providers: customers reach only their own data	—	لا شيء
A1.1.4	Multi-tenant providers: separation tested every six months	—	لا شيء
A1.2.1	Multi-tenant providers: audit logging for each customer	—	لا شيء
A1.2.2	Multi-tenant providers: support customer forensic investigations	—	لا شيء
A1.2.3	Multi-tenant providers: report suspected incidents to customers	—	لا شيء
A2.1.1	POI terminals using SSL or early TLS not exploitable	—	لا شيء
A2.1.2	Service providers: migration plan off SSL and early TLS	—	لا شيء
A2.1.3	Service providers offer a secure connection option	—	لا شيء

تغطية الموضوع

الموضوعات ذات متطلبات PCI DSS المربوطة (46):

لا يوجد ربط في بياناتنا لا يوجد متطلب PCI DSS (4):