PCI DSS v4.0.1

Perbandingan

Persyaratan

ID dan judul persyaratan ditampilkan sebagaimana diterbitkan masing-masing framework, dalam bahasa Inggris.

PCI DSS v4.0.1 persyaratan

ID	Persyaratan	Topik	Dipetakan dalam
Requirement 1: Install and maintain network security controls · 19
1.1.1	Network security policies documented and kept current	—	0
1.1.2	Roles for network security controls assigned	—	0
1.2.1	Configuration standards for network security controls	Firewall / Segmentasi Jaringan	9 dari 13
1.2.2	Network connection changes go through change control	—	tidak ada
1.2.3	Accurate network diagram maintained	Firewall / Segmentasi Jaringan	9 dari 13
1.2.4	Accurate account-data flow diagram maintained	—	0
1.2.5	Allowed services, protocols and ports approved	—	tidak ada
1.2.6	Security features defined for insecure services	—	tidak ada
1.2.7	Network security control rules reviewed every six months	—	tidak ada
1.2.8	Network security control configuration files secured	—	tidak ada
1.3.1	Inbound traffic to the CDE restricted	Firewall / Segmentasi Jaringan	9 dari 13
1.3.2	Outbound traffic from the CDE restricted	—	tidak ada
1.3.3	Network controls between wireless networks and the CDE	—	tidak ada
1.4.1	Network controls between trusted and untrusted networks	Firewall / Segmentasi Jaringan	9 dari 13
1.4.2	Inbound traffic from untrusted networks restricted	—	tidak ada
1.4.3	Anti-spoofing measures in place	—	tidak ada
1.4.4	Stored cardholder data not reachable from untrusted networks	—	tidak ada
1.4.5	Internal IP addresses and routing not disclosed	—	tidak ada
1.5.1	Controls on devices connecting to untrusted networks and the CDE	—	tidak ada
Requirement 2: Apply secure configurations to all system components · 11
2.1.1	Secure configuration policies documented and kept current	—	0
2.1.2	Roles for secure configuration assigned	—	0
2.2.1	System configuration standards developed and maintained	Konfigurasi Aman	9 dari 13
2.2.2	Vendor default accounts managed or removed	Konfigurasi Aman	9 dari 13
2.2.3	Functions with different security levels kept apart	—	tidak ada
2.2.4	Only necessary services and functions enabled	—	tidak ada
2.2.5	Insecure services justified and secured	—	tidak ada
2.2.6	System security parameters set to prevent misuse	—	tidak ada
2.2.7	Non-console administrative access encrypted	—	tidak ada
2.3.1	Wireless vendor defaults changed	—	0
2.3.2	Wireless keys changed when key holders leave	—	tidak ada
Requirement 3: Protect stored account data · 29
3.1.1	Stored account data policies documented and kept current	—	0
3.1.2	Roles for protecting stored account data assigned	—	0
3.2.1	Account data storage minimised, with retention and disposal	Perlindungan Data	11 dari 13
3.3.1	Sensitive authentication data not kept after authorisation	Perlindungan Data	11 dari 13
3.3.1.1	Full track data not kept after authorisation	—	tidak ada
3.3.1.2	Card verification code not kept after authorisation	—	tidak ada
3.3.1.3	PIN and PIN block not kept after authorisation	—	tidak ada
3.3.2	Sensitive authentication data encrypted before authorisation	—	tidak ada
3.3.3	Issuer storage of sensitive authentication data limited and protected	—	tidak ada
3.4.1	PAN masked when displayed	Perlindungan Data	11 dari 13
3.4.2	PAN copying prevented over remote-access technologies	DLP	7 dari 13
3.5.1	PAN rendered unreadable wherever stored	Enkripsi	10 dari 13
3.5.1.1	Hashes of PAN are keyed cryptographic hashes	—	tidak ada
3.5.1.2	Disk-level encryption used only where it suffices	—	tidak ada
3.5.1.3	Disk encryption access managed separately from OS access	—	0
3.6.1	Procedures protect keys that secure stored account data	Enkripsi	10 dari 13
3.6.1.1	Service providers document their cryptographic architecture	—	0
3.6.1.2	Secret and private keys stored in approved forms	—	0
3.6.1.3	Cleartext key components accessible to fewest custodians	—	0
3.6.1.4	Keys stored in the fewest possible locations	—	0
3.7.1	Key management: strong key generation	Enkripsi	10 dari 13
3.7.2	Key management: secure key distribution	—	tidak ada
3.7.3	Key management: secure key storage	—	tidak ada
3.7.4	Key management: key changes at end of cryptoperiod	Enkripsi	10 dari 13
3.7.5	Key management: retiring weakened or compromised keys	—	tidak ada
3.7.6	Key management: split knowledge and dual control	—	tidak ada
3.7.7	Key management: preventing unauthorised key substitution	—	tidak ada
3.7.8	Key custodians formally acknowledge their responsibilities	—	tidak ada
3.7.9	Service providers give customers key-handling guidance	—	tidak ada
Requirement 4: Protect cardholder data with strong cryptography during transmission · 6
4.1.1	Data-in-transit policies documented and kept current	—	0
4.1.2	Roles for protecting data in transit assigned	—	0
4.2.1	Strong cryptography for PAN over open, public networks	Enkripsi	10 dari 13
4.2.1.1	Inventory of trusted keys and certificates kept	Enkripsi	10 dari 13
4.2.1.2	Strong cryptography on wireless networks carrying PAN	—	tidak ada
4.2.2	PAN secured when sent by end-user messaging	—	tidak ada
Requirement 5: Protect all systems and networks from malicious software · 13
5.1.1	Anti-malware policies documented and kept current	—	0
5.1.2	Roles for malware protection assigned	—	0
5.2.1	Anti-malware deployed on system components	Perlindungan Endpoint	10 dari 13
5.2.2	Anti-malware detects, removes or contains known malware	Perlindungan Endpoint	10 dari 13
5.2.3	Systems without anti-malware periodically re-evaluated	—	0
5.2.3.1	Re-evaluation frequency set by targeted risk analysis	—	0
5.3.1	Anti-malware kept up to date	—	tidak ada
5.3.2	Periodic scans or continuous behavioural analysis	Perlindungan Endpoint	10 dari 13
5.3.2.1	Scan frequency set by targeted risk analysis	—	0
5.3.3	Removable media scanned or analysed	—	tidak ada
5.3.4	Anti-malware audit logs enabled and retained	—	tidak ada
5.3.5	Users cannot disable or alter anti-malware	—	tidak ada
5.4.1	Mechanisms to detect and protect against phishing	Keamanan Email	8 dari 13
Requirement 6: Develop and maintain secure systems and software · 19
6.1.1	Secure systems and software policies documented	—	0
6.1.2	Roles for secure systems and software assigned	—	0
6.2.1	Bespoke and custom software developed securely	Pengembangan Aman	8 dari 13
6.2.2	Developers trained in secure software development	Pengembangan Aman	8 dari 13
6.2.3	Custom code reviewed before release	Pengembangan Aman, Keamanan API	8 dari 13
6.2.3.1	Manual code reviews approved by someone else	—	0
6.2.4	Coding techniques prevent common software attacks	Keamanan API	4 dari 13
6.3.1	Vulnerabilities identified and risk-ranked	Manajemen Kerentanan, Intelijen Ancaman, Manajemen Patch	13 dari 13
6.3.2	Inventory of custom software and its components	Risiko Rantai Pasok, Manajemen Aset	13 dari 13
6.3.3	Security patches installed promptly	Manajemen Patch	10 dari 13
6.4.1	Public web applications protected against attacks	Keamanan Web	6 dari 13
6.4.2	Automated solution blocks attacks on public web apps	WAF	5 dari 13
6.4.3	Payment page scripts authorised and integrity-checked	Keamanan Web	6 dari 13
6.5.1	Production changes follow change control procedures	—	tidak ada
6.5.2	PCI DSS requirements re-confirmed after significant changes	—	tidak ada
6.5.3	Pre-production environments separated from production	—	tidak ada
6.5.4	Duties separated between production and pre-production	—	tidak ada
6.5.5	Live PANs not used in pre-production	—	tidak ada
6.5.6	Test data and accounts removed before go-live	—	tidak ada
Requirement 7: Restrict access to system components and cardholder data by business need to know · 12
7.1.1	Access restriction policies documented and kept current	—	0
7.1.2	Roles for access restriction assigned	—	0
7.2.1	Access control model defined	Kontrol Akses, Zero Trust	11 dari 13
7.2.2	Access assigned by job function and least privilege	Kontrol Akses, Akses Istimewa	12 dari 13
7.2.3	Privileges approved by authorised personnel	—	tidak ada
7.2.4	User accounts and privileges reviewed every six months	Kontrol Akses	11 dari 13
7.2.5	System and application accounts least privilege	—	tidak ada
7.2.5.1	System and application account access periodically reviewed	—	0
7.2.6	Access to cardholder data repositories restricted	—	tidak ada
7.3.1	Access control system restricts access by need	—	tidak ada
7.3.2	Access control system enforces assigned permissions	—	tidak ada
7.3.3	Access control system set to deny by default	—	tidak ada
Requirement 8: Identify users and authenticate access to system components · 29
8.1.1	Identification and authentication policies documented	—	0
8.1.2	Roles for identification and authentication assigned	—	0
8.2.1	Every user has a unique ID	Kontrol Akses	11 dari 13
8.2.2	Shared or generic accounts only by documented exception	—	0
8.2.3	Service providers use unique credentials per customer	—	tidak ada
8.2.4	User ID changes authorised and controlled	—	tidak ada
8.2.5	Access revoked immediately on termination	—	0
8.2.6	Inactive user accounts disabled within 90 days	—	0
8.2.7	Third-party remote access accounts enabled only when needed	—	tidak ada
8.2.8	Re-authentication after 15 minutes idle	—	0
8.3.1	User and admin access requires an authentication factor	Zero Trust	7 dari 13
8.3.2	Authentication factors unreadable in transit and storage	—	tidak ada
8.3.3	Identity verified before changing authentication factors	—	tidak ada
8.3.4	Account lockout after repeated failed attempts	—	tidak ada
8.3.5	First-use and reset passwords unique and changed	—	0
8.3.6	Minimum password length and complexity	—	0
8.3.7	Recent passwords cannot be reused	—	0
8.3.8	Authentication guidance communicated to users	—	0
8.3.9	Password-only access: change every 90 days or analyse risk	—	0
8.3.10	Service providers give customers password guidance	—	0
8.3.10.1	Service provider customer passwords: rotation or analysis	—	0
8.3.11	Tokens, smart cards and certificates assigned to individuals	—	tidak ada
8.4.1	MFA for non-console administrative access to the CDE	Autentikasi Multi-Faktor	10 dari 13
8.4.2	MFA for all access into the CDE	Autentikasi Multi-Faktor	10 dari 13
8.4.3	MFA for remote network access	Autentikasi Multi-Faktor	10 dari 13
8.5.1	MFA systems configured to resist misuse	Autentikasi Multi-Faktor	10 dari 13
8.6.1	Interactive use of system accounts managed	—	tidak ada
8.6.2	No hard-coded passwords for system accounts	—	0
8.6.3	System account passwords protected and changed	—	0
Requirement 9: Restrict physical access to cardholder data · 27
9.1.1	Physical security policies documented and kept current	—	0
9.1.2	Roles for physical security assigned	—	0
9.2.1	Facility entry controls restrict CDE access	Keamanan Fisik	8 dari 13
9.2.1.1	Access to sensitive areas monitored by camera or access control	Keamanan Fisik	8 dari 13
9.2.2	Publicly accessible network jacks restricted	—	tidak ada
9.2.3	Physical access to network hardware restricted	Keamanan Fisik	8 dari 13
9.2.4	Consoles in sensitive areas locked when unattended	—	0
9.3.1	Personnel physical access authorised and managed	Keamanan Fisik	8 dari 13
9.3.1.1	Sensitive-area access authorised and revoked promptly	Keamanan Fisik	8 dari 13
9.3.2	Visitor access authorised, escorted and identifiable	Keamanan Fisik	8 dari 13
9.3.3	Visitor badges returned or deactivated	—	tidak ada
9.3.4	Visitor log maintained and retained	—	tidak ada
9.4.1	Media with cardholder data physically secured	—	tidak ada
9.4.1.1	Offline backup media stored securely	Cadangan & Pemulihan	11 dari 13
9.4.1.2	Security of offline backup location reviewed annually	—	0
9.4.2	Media classified by data sensitivity	Klasifikasi Data	9 dari 13
9.4.3	Media sent off site tracked and secured	—	tidak ada
9.4.4	Management approves media moved off site	—	tidak ada
9.4.5	Inventory logs of electronic media kept	—	tidak ada
9.4.5.1	Electronic media inventories at least annually	—	tidak ada
9.4.6	Hard-copy media destroyed when no longer needed	—	0
9.4.7	Electronic media destroyed or made unrecoverable	—	0
9.5.1	Card-reading (POI) devices protected from tampering	—	tidak ada
9.5.1.1	Inventory of POI devices kept	—	0
9.5.1.2	POI devices inspected for tampering	—	0
9.5.1.2.1	Inspection frequency set by targeted risk analysis	—	0
9.5.1.3	Staff trained to spot POI tampering	—	tidak ada
Requirement 10: Log and monitor all access to system components and cardholder data · 27
10.1.1	Logging and monitoring policies documented	—	0
10.1.2	Roles for logging and monitoring assigned	—	0
10.2.1	Audit logs enabled and active	Pencatatan & Audit, Ancaman Orang Dalam	11 dari 13
10.2.1.1	Logs capture user access to cardholder data	—	tidak ada
10.2.1.2	Logs capture administrative actions	—	tidak ada
10.2.1.3	Logs capture access to audit logs	—	tidak ada
10.2.1.4	Logs capture invalid access attempts	—	tidak ada
10.2.1.5	Logs capture credential and privilege changes	—	tidak ada
10.2.1.6	Logs capture starting, stopping or pausing logging	—	tidak ada
10.2.1.7	Logs capture system-level object changes	—	tidak ada
10.2.2	Log entries record who, what, when, where and outcome	—	0
10.3.1	Read access to logs limited to need	—	0
10.3.2	Logs protected from modification	Pencatatan & Audit, Forensik	10 dari 13
10.3.3	Logs promptly backed up to a central server	—	0
10.3.4	File-integrity monitoring on logs	—	0
10.4.1	Security event and critical logs reviewed daily	Pemantauan Berkelanjutan, SIEM / SOC	10 dari 13
10.4.1.1	Automated mechanisms for log review	Deteksi Anomali	9 dari 13
10.4.2	Other logs reviewed periodically	—	tidak ada
10.4.2.1	Review frequency set by targeted risk analysis	—	0
10.4.3	Exceptions and anomalies addressed	—	tidak ada
10.5.1	Audit logs retained 12 months, three immediately available	Pencatatan & Audit	10 dari 13
10.6.1	System clocks synchronised	Pencatatan & Audit	10 dari 13
10.6.2	Time configuration correct and consistent	—	tidak ada
10.6.3	Time settings protected from change	—	0
10.7.1	Service providers detect security control failures	—	0
10.7.2	Critical security control failures detected and reported	—	0
10.7.3	Security control failures responded to promptly	—	tidak ada
Requirement 11: Test security of systems and networks regularly · 21
11.1.1	Security testing policies documented and kept current	—	0
11.1.2	Roles for security testing assigned	—	0
11.2.1	Wireless access points detected and unauthorised ones handled	—	0
11.2.2	Inventory of authorised wireless access points	—	tidak ada
11.3.1	Internal vulnerability scans every three months	Manajemen Kerentanan	13 dari 13
11.3.1.1	Lower-ranked vulnerabilities handled by risk analysis	—	0
11.3.1.2	Internal scans use authenticated scanning	—	tidak ada
11.3.1.3	Internal scans after significant changes	—	tidak ada
11.3.2	External ASV scans every three months	Manajemen Kerentanan	13 dari 13
11.3.2.1	External scans after significant changes	—	tidak ada
11.4.1	Penetration testing methodology defined	—	tidak ada
11.4.2	Internal penetration test at least annually	—	tidak ada
11.4.3	External penetration test at least annually	—	tidak ada
11.4.4	Penetration test findings corrected and retested	—	0
11.4.5	Segmentation controls tested at least annually	—	tidak ada
11.4.6	Service providers test segmentation every six months	—	tidak ada
11.4.7	Multi-tenant providers support customer penetration tests	—	tidak ada
11.5.1	Intrusion detection or prevention on network traffic	Deteksi Intrusi	9 dari 13
11.5.1.1	Service providers detect covert malware communication	—	tidak ada
11.5.2	Change-detection on critical files	—	tidak ada
11.6.1	Payment page changes and tampering detected	—	0
Requirement 12: Support information security with organizational policies and programs · 37
12.1.1	Information security policy established and published	Kebijakan Tata Kelola	9 dari 13
12.1.2	Security policy reviewed at least annually	Kebijakan Tata Kelola	9 dari 13
12.1.3	Security roles and responsibilities defined	Peran & Tanggung Jawab	9 dari 13
12.1.4	Executive responsibility for information security assigned	Peran & Tanggung Jawab	9 dari 13
12.2.1	Acceptable use policies for end-user technologies	—	tidak ada
12.3.1	Targeted risk analysis for flexible-frequency requirements	Manajemen Risiko, Penilaian Risiko	10 dari 13
12.3.2	Targeted risk analysis for customised approach	—	0
12.3.3	Cipher suites and protocols reviewed annually	—	0
12.3.4	Hardware and software technologies reviewed annually	—	0
12.4.1	Service providers: executive responsibility for PCI DSS compliance	—	tidak ada
12.4.2	Service providers: quarterly reviews of operational tasks	Kepatuhan	10 dari 13
12.4.2.1	Service providers: quarterly review results documented	—	0
12.5.1	Inventory of in-scope system components	Manajemen Aset	13 dari 13
12.5.2	PCI DSS scope confirmed annually and on change	Lingkungan Bisnis	5 dari 13
12.5.2.1	Service providers confirm scope every six months	—	tidak ada
12.5.3	Service providers review scope after organisational change	—	0
12.6.1	Formal security awareness programme	Kesadaran & Pelatihan	10 dari 13
12.6.2	Awareness programme reviewed annually	—	tidak ada
12.6.3	Awareness training on hire and at least annually	Kesadaran & Pelatihan	10 dari 13
12.6.3.1	Training covers phishing and social engineering	—	tidak ada
12.6.3.2	Training covers acceptable use of technology	—	tidak ada
12.7.1	Personnel screened before hire	Ancaman Orang Dalam	8 dari 13
12.8.1	List of third-party service providers kept	Risiko Rantai Pasok, Keamanan Cloud, Manajemen Risiko Vendor	12 dari 13
12.8.2	Written agreements with service providers	Manajemen Risiko Vendor	10 dari 13
12.8.3	Due diligence before engaging service providers	Manajemen Risiko Vendor	10 dari 13
12.8.4	Service provider compliance monitored annually	Manajemen Risiko Vendor	10 dari 13
12.8.5	Responsibilities split with each provider documented	Keamanan Cloud, Manajemen Risiko Vendor	12 dari 13
12.9.1	Service providers acknowledge responsibilities to customers	—	0
12.9.2	Service providers support customer compliance requests	—	0
12.10.1	Incident response plan ready to activate	Respons Insiden, Mitigasi, Pelaporan, Perencanaan Pemulihan, Kelangsungan Usaha, Pemulihan Bencana	12 dari 13
12.10.2	Incident response plan reviewed and tested annually	Respons Insiden	12 dari 13
12.10.3	Incident response staff available around the clock	Respons Insiden	12 dari 13
12.10.4	Incident response staff trained	Respons Insiden	12 dari 13
12.10.4.1	Training frequency set by targeted risk analysis	—	0
12.10.5	Plan covers alerts from security monitoring	—	0
12.10.6	Plan updated from lessons learned and industry changes	Pelajaran yang Dipetik	9 dari 13
12.10.7	Procedures for PAN found where it shouldn't be	—	0
Appendix A: additional requirements · 10
A1.1.1	Multi-tenant providers: separate provider and customer environments	—	tidak ada
A1.1.2	Multi-tenant providers: customers confined to their own environment	—	tidak ada
A1.1.3	Multi-tenant providers: customers reach only their own data	—	tidak ada
A1.1.4	Multi-tenant providers: separation tested every six months	—	tidak ada
A1.2.1	Multi-tenant providers: audit logging for each customer	—	tidak ada
A1.2.2	Multi-tenant providers: support customer forensic investigations	—	tidak ada
A1.2.3	Multi-tenant providers: report suspected incidents to customers	—	tidak ada
A2.1.1	POI terminals using SSL or early TLS not exploitable	—	tidak ada
A2.1.2	Service providers: migration plan off SSL and early TLS	—	tidak ada
A2.1.3	Service providers offer a secure connection option	—	tidak ada

Cakupan topik

Topik dengan persyaratan PCI DSS yang dipetakan (46):

Tidak ada pemetaan dalam data kami Tidak ada persyaratan PCI DSS (4):