PCI DSS v4.0.1

तुलनाएँ

आवश्यकताएँ

आवश्यकता की ID और शीर्षक हर फ़्रेमवर्क द्वारा प्रकाशित रूप में, अंग्रेज़ी में दिखाए जाते हैं।

PCI DSS v4.0.1 आवश्यकताएँ

ID	आवश्यकता	विषय	में मैप किया गया
Requirement 1: Install and maintain network security controls · 19
1.1.1	Network security policies documented and kept current	—	0
1.1.2	Roles for network security controls assigned	—	0
1.2.1	Configuration standards for network security controls	फ़ायरवॉल / नेट सेग	13 में से 9
1.2.2	Network connection changes go through change control	—	कोई नहीं
1.2.3	Accurate network diagram maintained	फ़ायरवॉल / नेट सेग	13 में से 9
1.2.4	Accurate account-data flow diagram maintained	—	0
1.2.5	Allowed services, protocols and ports approved	—	कोई नहीं
1.2.6	Security features defined for insecure services	—	कोई नहीं
1.2.7	Network security control rules reviewed every six months	—	कोई नहीं
1.2.8	Network security control configuration files secured	—	कोई नहीं
1.3.1	Inbound traffic to the CDE restricted	फ़ायरवॉल / नेट सेग	13 में से 9
1.3.2	Outbound traffic from the CDE restricted	—	कोई नहीं
1.3.3	Network controls between wireless networks and the CDE	—	कोई नहीं
1.4.1	Network controls between trusted and untrusted networks	फ़ायरवॉल / नेट सेग	13 में से 9
1.4.2	Inbound traffic from untrusted networks restricted	—	कोई नहीं
1.4.3	Anti-spoofing measures in place	—	कोई नहीं
1.4.4	Stored cardholder data not reachable from untrusted networks	—	कोई नहीं
1.4.5	Internal IP addresses and routing not disclosed	—	कोई नहीं
1.5.1	Controls on devices connecting to untrusted networks and the CDE	—	कोई नहीं
Requirement 2: Apply secure configurations to all system components · 11
2.1.1	Secure configuration policies documented and kept current	—	0
2.1.2	Roles for secure configuration assigned	—	0
2.2.1	System configuration standards developed and maintained	सुरक्षित कॉन्फ़िगरेशन	13 में से 9
2.2.2	Vendor default accounts managed or removed	सुरक्षित कॉन्फ़िगरेशन	13 में से 9
2.2.3	Functions with different security levels kept apart	—	कोई नहीं
2.2.4	Only necessary services and functions enabled	—	कोई नहीं
2.2.5	Insecure services justified and secured	—	कोई नहीं
2.2.6	System security parameters set to prevent misuse	—	कोई नहीं
2.2.7	Non-console administrative access encrypted	—	कोई नहीं
2.3.1	Wireless vendor defaults changed	—	0
2.3.2	Wireless keys changed when key holders leave	—	कोई नहीं
Requirement 3: Protect stored account data · 29
3.1.1	Stored account data policies documented and kept current	—	0
3.1.2	Roles for protecting stored account data assigned	—	0
3.2.1	Account data storage minimised, with retention and disposal	डेटा संरक्षण	13 में से 11
3.3.1	Sensitive authentication data not kept after authorisation	डेटा संरक्षण	13 में से 11
3.3.1.1	Full track data not kept after authorisation	—	कोई नहीं
3.3.1.2	Card verification code not kept after authorisation	—	कोई नहीं
3.3.1.3	PIN and PIN block not kept after authorisation	—	कोई नहीं
3.3.2	Sensitive authentication data encrypted before authorisation	—	कोई नहीं
3.3.3	Issuer storage of sensitive authentication data limited and protected	—	कोई नहीं
3.4.1	PAN masked when displayed	डेटा संरक्षण	13 में से 11
3.4.2	PAN copying prevented over remote-access technologies	DLP	13 में से 7
3.5.1	PAN rendered unreadable wherever stored	एन्क्रिप्शन	13 में से 10
3.5.1.1	Hashes of PAN are keyed cryptographic hashes	—	कोई नहीं
3.5.1.2	Disk-level encryption used only where it suffices	—	कोई नहीं
3.5.1.3	Disk encryption access managed separately from OS access	—	0
3.6.1	Procedures protect keys that secure stored account data	एन्क्रिप्शन	13 में से 10
3.6.1.1	Service providers document their cryptographic architecture	—	0
3.6.1.2	Secret and private keys stored in approved forms	—	0
3.6.1.3	Cleartext key components accessible to fewest custodians	—	0
3.6.1.4	Keys stored in the fewest possible locations	—	0
3.7.1	Key management: strong key generation	एन्क्रिप्शन	13 में से 10
3.7.2	Key management: secure key distribution	—	कोई नहीं
3.7.3	Key management: secure key storage	—	कोई नहीं
3.7.4	Key management: key changes at end of cryptoperiod	एन्क्रिप्शन	13 में से 10
3.7.5	Key management: retiring weakened or compromised keys	—	कोई नहीं
3.7.6	Key management: split knowledge and dual control	—	कोई नहीं
3.7.7	Key management: preventing unauthorised key substitution	—	कोई नहीं
3.7.8	Key custodians formally acknowledge their responsibilities	—	कोई नहीं
3.7.9	Service providers give customers key-handling guidance	—	कोई नहीं
Requirement 4: Protect cardholder data with strong cryptography during transmission · 6
4.1.1	Data-in-transit policies documented and kept current	—	0
4.1.2	Roles for protecting data in transit assigned	—	0
4.2.1	Strong cryptography for PAN over open, public networks	एन्क्रिप्शन	13 में से 10
4.2.1.1	Inventory of trusted keys and certificates kept	एन्क्रिप्शन	13 में से 10
4.2.1.2	Strong cryptography on wireless networks carrying PAN	—	कोई नहीं
4.2.2	PAN secured when sent by end-user messaging	—	कोई नहीं
Requirement 5: Protect all systems and networks from malicious software · 13
5.1.1	Anti-malware policies documented and kept current	—	0
5.1.2	Roles for malware protection assigned	—	0
5.2.1	Anti-malware deployed on system components	एंडपॉइंट सुरक्षा	13 में से 10
5.2.2	Anti-malware detects, removes or contains known malware	एंडपॉइंट सुरक्षा	13 में से 10
5.2.3	Systems without anti-malware periodically re-evaluated	—	0
5.2.3.1	Re-evaluation frequency set by targeted risk analysis	—	0
5.3.1	Anti-malware kept up to date	—	कोई नहीं
5.3.2	Periodic scans or continuous behavioural analysis	एंडपॉइंट सुरक्षा	13 में से 10
5.3.2.1	Scan frequency set by targeted risk analysis	—	0
5.3.3	Removable media scanned or analysed	—	कोई नहीं
5.3.4	Anti-malware audit logs enabled and retained	—	कोई नहीं
5.3.5	Users cannot disable or alter anti-malware	—	कोई नहीं
5.4.1	Mechanisms to detect and protect against phishing	ईमेल सुरक्षा	13 में से 8
Requirement 6: Develop and maintain secure systems and software · 19
6.1.1	Secure systems and software policies documented	—	0
6.1.2	Roles for secure systems and software assigned	—	0
6.2.1	Bespoke and custom software developed securely	सुरक्षित विकास	13 में से 8
6.2.2	Developers trained in secure software development	सुरक्षित विकास	13 में से 8
6.2.3	Custom code reviewed before release	सुरक्षित विकास, API सुरक्षा	13 में से 8
6.2.3.1	Manual code reviews approved by someone else	—	0
6.2.4	Coding techniques prevent common software attacks	API सुरक्षा	13 में से 4
6.3.1	Vulnerabilities identified and risk-ranked	भेद्यता प्रबंधन, थ्रेट इंटेलिजेंस, पैच प्रबंधन	13 में से 13
6.3.2	Inventory of custom software and its components	आपूर्ति श्रृंखला जोखिम, एसेट प्रबंधन	13 में से 13
6.3.3	Security patches installed promptly	पैच प्रबंधन	13 में से 10
6.4.1	Public web applications protected against attacks	वेब सुरक्षा	13 में से 6
6.4.2	Automated solution blocks attacks on public web apps	WAF	13 में से 5
6.4.3	Payment page scripts authorised and integrity-checked	वेब सुरक्षा	13 में से 6
6.5.1	Production changes follow change control procedures	—	कोई नहीं
6.5.2	PCI DSS requirements re-confirmed after significant changes	—	कोई नहीं
6.5.3	Pre-production environments separated from production	—	कोई नहीं
6.5.4	Duties separated between production and pre-production	—	कोई नहीं
6.5.5	Live PANs not used in pre-production	—	कोई नहीं
6.5.6	Test data and accounts removed before go-live	—	कोई नहीं
Requirement 7: Restrict access to system components and cardholder data by business need to know · 12
7.1.1	Access restriction policies documented and kept current	—	0
7.1.2	Roles for access restriction assigned	—	0
7.2.1	Access control model defined	एक्सेस कंट्रोल, ज़ीरो ट्रस्ट	13 में से 11
7.2.2	Access assigned by job function and least privilege	एक्सेस कंट्रोल, विशेषाधिकार प्राप्त पहुँच	13 में से 12
7.2.3	Privileges approved by authorised personnel	—	कोई नहीं
7.2.4	User accounts and privileges reviewed every six months	एक्सेस कंट्रोल	13 में से 11
7.2.5	System and application accounts least privilege	—	कोई नहीं
7.2.5.1	System and application account access periodically reviewed	—	0
7.2.6	Access to cardholder data repositories restricted	—	कोई नहीं
7.3.1	Access control system restricts access by need	—	कोई नहीं
7.3.2	Access control system enforces assigned permissions	—	कोई नहीं
7.3.3	Access control system set to deny by default	—	कोई नहीं
Requirement 8: Identify users and authenticate access to system components · 29
8.1.1	Identification and authentication policies documented	—	0
8.1.2	Roles for identification and authentication assigned	—	0
8.2.1	Every user has a unique ID	एक्सेस कंट्रोल	13 में से 11
8.2.2	Shared or generic accounts only by documented exception	—	0
8.2.3	Service providers use unique credentials per customer	—	कोई नहीं
8.2.4	User ID changes authorised and controlled	—	कोई नहीं
8.2.5	Access revoked immediately on termination	—	0
8.2.6	Inactive user accounts disabled within 90 days	—	0
8.2.7	Third-party remote access accounts enabled only when needed	—	कोई नहीं
8.2.8	Re-authentication after 15 minutes idle	—	0
8.3.1	User and admin access requires an authentication factor	ज़ीरो ट्रस्ट	13 में से 7
8.3.2	Authentication factors unreadable in transit and storage	—	कोई नहीं
8.3.3	Identity verified before changing authentication factors	—	कोई नहीं
8.3.4	Account lockout after repeated failed attempts	—	कोई नहीं
8.3.5	First-use and reset passwords unique and changed	—	0
8.3.6	Minimum password length and complexity	—	0
8.3.7	Recent passwords cannot be reused	—	0
8.3.8	Authentication guidance communicated to users	—	0
8.3.9	Password-only access: change every 90 days or analyse risk	—	0
8.3.10	Service providers give customers password guidance	—	0
8.3.10.1	Service provider customer passwords: rotation or analysis	—	0
8.3.11	Tokens, smart cards and certificates assigned to individuals	—	कोई नहीं
8.4.1	MFA for non-console administrative access to the CDE	मल्टी-फ़ैक्टर ऑथेंटिकेशन	13 में से 10
8.4.2	MFA for all access into the CDE	मल्टी-फ़ैक्टर ऑथेंटिकेशन	13 में से 10
8.4.3	MFA for remote network access	मल्टी-फ़ैक्टर ऑथेंटिकेशन	13 में से 10
8.5.1	MFA systems configured to resist misuse	मल्टी-फ़ैक्टर ऑथेंटिकेशन	13 में से 10
8.6.1	Interactive use of system accounts managed	—	कोई नहीं
8.6.2	No hard-coded passwords for system accounts	—	0
8.6.3	System account passwords protected and changed	—	0
Requirement 9: Restrict physical access to cardholder data · 27
9.1.1	Physical security policies documented and kept current	—	0
9.1.2	Roles for physical security assigned	—	0
9.2.1	Facility entry controls restrict CDE access	भौतिक सुरक्षा	13 में से 8
9.2.1.1	Access to sensitive areas monitored by camera or access control	भौतिक सुरक्षा	13 में से 8
9.2.2	Publicly accessible network jacks restricted	—	कोई नहीं
9.2.3	Physical access to network hardware restricted	भौतिक सुरक्षा	13 में से 8
9.2.4	Consoles in sensitive areas locked when unattended	—	0
9.3.1	Personnel physical access authorised and managed	भौतिक सुरक्षा	13 में से 8
9.3.1.1	Sensitive-area access authorised and revoked promptly	भौतिक सुरक्षा	13 में से 8
9.3.2	Visitor access authorised, escorted and identifiable	भौतिक सुरक्षा	13 में से 8
9.3.3	Visitor badges returned or deactivated	—	कोई नहीं
9.3.4	Visitor log maintained and retained	—	कोई नहीं
9.4.1	Media with cardholder data physically secured	—	कोई नहीं
9.4.1.1	Offline backup media stored securely	बैकअप और रिकवरी	13 में से 11
9.4.1.2	Security of offline backup location reviewed annually	—	0
9.4.2	Media classified by data sensitivity	डेटा वर्गीकरण	13 में से 9
9.4.3	Media sent off site tracked and secured	—	कोई नहीं
9.4.4	Management approves media moved off site	—	कोई नहीं
9.4.5	Inventory logs of electronic media kept	—	कोई नहीं
9.4.5.1	Electronic media inventories at least annually	—	कोई नहीं
9.4.6	Hard-copy media destroyed when no longer needed	—	0
9.4.7	Electronic media destroyed or made unrecoverable	—	0
9.5.1	Card-reading (POI) devices protected from tampering	—	कोई नहीं
9.5.1.1	Inventory of POI devices kept	—	0
9.5.1.2	POI devices inspected for tampering	—	0
9.5.1.2.1	Inspection frequency set by targeted risk analysis	—	0
9.5.1.3	Staff trained to spot POI tampering	—	कोई नहीं
Requirement 10: Log and monitor all access to system components and cardholder data · 27
10.1.1	Logging and monitoring policies documented	—	0
10.1.2	Roles for logging and monitoring assigned	—	0
10.2.1	Audit logs enabled and active	लॉगिंग और ऑडिट, इनसाइडर थ्रेट	13 में से 11
10.2.1.1	Logs capture user access to cardholder data	—	कोई नहीं
10.2.1.2	Logs capture administrative actions	—	कोई नहीं
10.2.1.3	Logs capture access to audit logs	—	कोई नहीं
10.2.1.4	Logs capture invalid access attempts	—	कोई नहीं
10.2.1.5	Logs capture credential and privilege changes	—	कोई नहीं
10.2.1.6	Logs capture starting, stopping or pausing logging	—	कोई नहीं
10.2.1.7	Logs capture system-level object changes	—	कोई नहीं
10.2.2	Log entries record who, what, when, where and outcome	—	0
10.3.1	Read access to logs limited to need	—	0
10.3.2	Logs protected from modification	लॉगिंग और ऑडिट, फ़ॉरेंसिक	13 में से 10
10.3.3	Logs promptly backed up to a central server	—	0
10.3.4	File-integrity monitoring on logs	—	0
10.4.1	Security event and critical logs reviewed daily	सतत निगरानी, SIEM / SOC	13 में से 10
10.4.1.1	Automated mechanisms for log review	विसंगति पहचान (Anomaly Detection)	13 में से 9
10.4.2	Other logs reviewed periodically	—	कोई नहीं
10.4.2.1	Review frequency set by targeted risk analysis	—	0
10.4.3	Exceptions and anomalies addressed	—	कोई नहीं
10.5.1	Audit logs retained 12 months, three immediately available	लॉगिंग और ऑडिट	13 में से 10
10.6.1	System clocks synchronised	लॉगिंग और ऑडिट	13 में से 10
10.6.2	Time configuration correct and consistent	—	कोई नहीं
10.6.3	Time settings protected from change	—	0
10.7.1	Service providers detect security control failures	—	0
10.7.2	Critical security control failures detected and reported	—	0
10.7.3	Security control failures responded to promptly	—	कोई नहीं
Requirement 11: Test security of systems and networks regularly · 21
11.1.1	Security testing policies documented and kept current	—	0
11.1.2	Roles for security testing assigned	—	0
11.2.1	Wireless access points detected and unauthorised ones handled	—	0
11.2.2	Inventory of authorised wireless access points	—	कोई नहीं
11.3.1	Internal vulnerability scans every three months	भेद्यता प्रबंधन	13 में से 13
11.3.1.1	Lower-ranked vulnerabilities handled by risk analysis	—	0
11.3.1.2	Internal scans use authenticated scanning	—	कोई नहीं
11.3.1.3	Internal scans after significant changes	—	कोई नहीं
11.3.2	External ASV scans every three months	भेद्यता प्रबंधन	13 में से 13
11.3.2.1	External scans after significant changes	—	कोई नहीं
11.4.1	Penetration testing methodology defined	—	कोई नहीं
11.4.2	Internal penetration test at least annually	—	कोई नहीं
11.4.3	External penetration test at least annually	—	कोई नहीं
11.4.4	Penetration test findings corrected and retested	—	0
11.4.5	Segmentation controls tested at least annually	—	कोई नहीं
11.4.6	Service providers test segmentation every six months	—	कोई नहीं
11.4.7	Multi-tenant providers support customer penetration tests	—	कोई नहीं
11.5.1	Intrusion detection or prevention on network traffic	घुसपैठ का पता लगाना	13 में से 9
11.5.1.1	Service providers detect covert malware communication	—	कोई नहीं
11.5.2	Change-detection on critical files	—	कोई नहीं
11.6.1	Payment page changes and tampering detected	—	0
Requirement 12: Support information security with organizational policies and programs · 37
12.1.1	Information security policy established and published	शासन नीति	13 में से 9
12.1.2	Security policy reviewed at least annually	शासन नीति	13 में से 9
12.1.3	Security roles and responsibilities defined	भूमिकाएँ और उत्तरदायित्व	13 में से 9
12.1.4	Executive responsibility for information security assigned	भूमिकाएँ और उत्तरदायित्व	13 में से 9
12.2.1	Acceptable use policies for end-user technologies	—	कोई नहीं
12.3.1	Targeted risk analysis for flexible-frequency requirements	जोखिम प्रबंधन, जोखिम मूल्यांकन	13 में से 10
12.3.2	Targeted risk analysis for customised approach	—	0
12.3.3	Cipher suites and protocols reviewed annually	—	0
12.3.4	Hardware and software technologies reviewed annually	—	0
12.4.1	Service providers: executive responsibility for PCI DSS compliance	—	कोई नहीं
12.4.2	Service providers: quarterly reviews of operational tasks	अनुपालन	13 में से 10
12.4.2.1	Service providers: quarterly review results documented	—	0
12.5.1	Inventory of in-scope system components	एसेट प्रबंधन	13 में से 13
12.5.2	PCI DSS scope confirmed annually and on change	व्यावसायिक परिवेश	13 में से 5
12.5.2.1	Service providers confirm scope every six months	—	कोई नहीं
12.5.3	Service providers review scope after organisational change	—	0
12.6.1	Formal security awareness programme	जागरूकता और प्रशिक्षण	13 में से 10
12.6.2	Awareness programme reviewed annually	—	कोई नहीं
12.6.3	Awareness training on hire and at least annually	जागरूकता और प्रशिक्षण	13 में से 10
12.6.3.1	Training covers phishing and social engineering	—	कोई नहीं
12.6.3.2	Training covers acceptable use of technology	—	कोई नहीं
12.7.1	Personnel screened before hire	इनसाइडर थ्रेट	13 में से 8
12.8.1	List of third-party service providers kept	आपूर्ति श्रृंखला जोखिम, क्लाउड सुरक्षा, वेंडर जोखिम प्रबंधन	13 में से 12
12.8.2	Written agreements with service providers	वेंडर जोखिम प्रबंधन	13 में से 10
12.8.3	Due diligence before engaging service providers	वेंडर जोखिम प्रबंधन	13 में से 10
12.8.4	Service provider compliance monitored annually	वेंडर जोखिम प्रबंधन	13 में से 10
12.8.5	Responsibilities split with each provider documented	क्लाउड सुरक्षा, वेंडर जोखिम प्रबंधन	13 में से 12
12.9.1	Service providers acknowledge responsibilities to customers	—	0
12.9.2	Service providers support customer compliance requests	—	0
12.10.1	Incident response plan ready to activate	घटना प्रतिक्रिया, शमन, रिपोर्टिंग, रिकवरी योजना, व्यवसाय निरंतरता, आपदा पुनर्प्राप्ति	13 में से 12
12.10.2	Incident response plan reviewed and tested annually	घटना प्रतिक्रिया	13 में से 12
12.10.3	Incident response staff available around the clock	घटना प्रतिक्रिया	13 में से 12
12.10.4	Incident response staff trained	घटना प्रतिक्रिया	13 में से 12
12.10.4.1	Training frequency set by targeted risk analysis	—	0
12.10.5	Plan covers alerts from security monitoring	—	0
12.10.6	Plan updated from lessons learned and industry changes	सीखे गए सबक	13 में से 9
12.10.7	Procedures for PAN found where it shouldn't be	—	0
Appendix A: additional requirements · 10
A1.1.1	Multi-tenant providers: separate provider and customer environments	—	कोई नहीं
A1.1.2	Multi-tenant providers: customers confined to their own environment	—	कोई नहीं
A1.1.3	Multi-tenant providers: customers reach only their own data	—	कोई नहीं
A1.1.4	Multi-tenant providers: separation tested every six months	—	कोई नहीं
A1.2.1	Multi-tenant providers: audit logging for each customer	—	कोई नहीं
A1.2.2	Multi-tenant providers: support customer forensic investigations	—	कोई नहीं
A1.2.3	Multi-tenant providers: report suspected incidents to customers	—	कोई नहीं
A2.1.1	POI terminals using SSL or early TLS not exploitable	—	कोई नहीं
A2.1.2	Service providers: migration plan off SSL and early TLS	—	कोई नहीं
A2.1.3	Service providers offer a secure connection option	—	कोई नहीं

विषय कवरेज

PCI DSS की मैप की गई आवश्यकताओं वाले विषय (46):

हमारे डेटा में कोई मैपिंग नहीं कोई PCI DSS आवश्यकता नहीं (4):