PCI DSS v4.0.1

比較一覧

要件

要件 ID とタイトルは、各フレームワークが公開している英語の表記のまま表示しています。

PCI DSS v4.0.1 要件

ID	要件	トピック	マッピング先:
Requirement 1: Install and maintain network security controls · 19
1.1.1	Network security policies documented and kept current	—	0
1.1.2	Roles for network security controls assigned	—	0
1.2.1	Configuration standards for network security controls	ファイアウォール / ネットワークセグメンテーション	13 件中 9 件
1.2.2	Network connection changes go through change control	—	なし
1.2.3	Accurate network diagram maintained	ファイアウォール / ネットワークセグメンテーション	13 件中 9 件
1.2.4	Accurate account-data flow diagram maintained	—	0
1.2.5	Allowed services, protocols and ports approved	—	なし
1.2.6	Security features defined for insecure services	—	なし
1.2.7	Network security control rules reviewed every six months	—	なし
1.2.8	Network security control configuration files secured	—	なし
1.3.1	Inbound traffic to the CDE restricted	ファイアウォール / ネットワークセグメンテーション	13 件中 9 件
1.3.2	Outbound traffic from the CDE restricted	—	なし
1.3.3	Network controls between wireless networks and the CDE	—	なし
1.4.1	Network controls between trusted and untrusted networks	ファイアウォール / ネットワークセグメンテーション	13 件中 9 件
1.4.2	Inbound traffic from untrusted networks restricted	—	なし
1.4.3	Anti-spoofing measures in place	—	なし
1.4.4	Stored cardholder data not reachable from untrusted networks	—	なし
1.4.5	Internal IP addresses and routing not disclosed	—	なし
1.5.1	Controls on devices connecting to untrusted networks and the CDE	—	なし
Requirement 2: Apply secure configurations to all system components · 11
2.1.1	Secure configuration policies documented and kept current	—	0
2.1.2	Roles for secure configuration assigned	—	0
2.2.1	System configuration standards developed and maintained	安全な構成	13 件中 9 件
2.2.2	Vendor default accounts managed or removed	安全な構成	13 件中 9 件
2.2.3	Functions with different security levels kept apart	—	なし
2.2.4	Only necessary services and functions enabled	—	なし
2.2.5	Insecure services justified and secured	—	なし
2.2.6	System security parameters set to prevent misuse	—	なし
2.2.7	Non-console administrative access encrypted	—	なし
2.3.1	Wireless vendor defaults changed	—	0
2.3.2	Wireless keys changed when key holders leave	—	なし
Requirement 3: Protect stored account data · 29
3.1.1	Stored account data policies documented and kept current	—	0
3.1.2	Roles for protecting stored account data assigned	—	0
3.2.1	Account data storage minimised, with retention and disposal	データ保護	13 件中 11 件
3.3.1	Sensitive authentication data not kept after authorisation	データ保護	13 件中 11 件
3.3.1.1	Full track data not kept after authorisation	—	なし
3.3.1.2	Card verification code not kept after authorisation	—	なし
3.3.1.3	PIN and PIN block not kept after authorisation	—	なし
3.3.2	Sensitive authentication data encrypted before authorisation	—	なし
3.3.3	Issuer storage of sensitive authentication data limited and protected	—	なし
3.4.1	PAN masked when displayed	データ保護	13 件中 11 件
3.4.2	PAN copying prevented over remote-access technologies	DLP	13 件中 7 件
3.5.1	PAN rendered unreadable wherever stored	暗号化	13 件中 10 件
3.5.1.1	Hashes of PAN are keyed cryptographic hashes	—	なし
3.5.1.2	Disk-level encryption used only where it suffices	—	なし
3.5.1.3	Disk encryption access managed separately from OS access	—	0
3.6.1	Procedures protect keys that secure stored account data	暗号化	13 件中 10 件
3.6.1.1	Service providers document their cryptographic architecture	—	0
3.6.1.2	Secret and private keys stored in approved forms	—	0
3.6.1.3	Cleartext key components accessible to fewest custodians	—	0
3.6.1.4	Keys stored in the fewest possible locations	—	0
3.7.1	Key management: strong key generation	暗号化	13 件中 10 件
3.7.2	Key management: secure key distribution	—	なし
3.7.3	Key management: secure key storage	—	なし
3.7.4	Key management: key changes at end of cryptoperiod	暗号化	13 件中 10 件
3.7.5	Key management: retiring weakened or compromised keys	—	なし
3.7.6	Key management: split knowledge and dual control	—	なし
3.7.7	Key management: preventing unauthorised key substitution	—	なし
3.7.8	Key custodians formally acknowledge their responsibilities	—	なし
3.7.9	Service providers give customers key-handling guidance	—	なし
Requirement 4: Protect cardholder data with strong cryptography during transmission · 6
4.1.1	Data-in-transit policies documented and kept current	—	0
4.1.2	Roles for protecting data in transit assigned	—	0
4.2.1	Strong cryptography for PAN over open, public networks	暗号化	13 件中 10 件
4.2.1.1	Inventory of trusted keys and certificates kept	暗号化	13 件中 10 件
4.2.1.2	Strong cryptography on wireless networks carrying PAN	—	なし
4.2.2	PAN secured when sent by end-user messaging	—	なし
Requirement 5: Protect all systems and networks from malicious software · 13
5.1.1	Anti-malware policies documented and kept current	—	0
5.1.2	Roles for malware protection assigned	—	0
5.2.1	Anti-malware deployed on system components	エンドポイント保護	13 件中 10 件
5.2.2	Anti-malware detects, removes or contains known malware	エンドポイント保護	13 件中 10 件
5.2.3	Systems without anti-malware periodically re-evaluated	—	0
5.2.3.1	Re-evaluation frequency set by targeted risk analysis	—	0
5.3.1	Anti-malware kept up to date	—	なし
5.3.2	Periodic scans or continuous behavioural analysis	エンドポイント保護	13 件中 10 件
5.3.2.1	Scan frequency set by targeted risk analysis	—	0
5.3.3	Removable media scanned or analysed	—	なし
5.3.4	Anti-malware audit logs enabled and retained	—	なし
5.3.5	Users cannot disable or alter anti-malware	—	なし
5.4.1	Mechanisms to detect and protect against phishing	メールセキュリティ	13 件中 8 件
Requirement 6: Develop and maintain secure systems and software · 19
6.1.1	Secure systems and software policies documented	—	0
6.1.2	Roles for secure systems and software assigned	—	0
6.2.1	Bespoke and custom software developed securely	セキュア開発	13 件中 8 件
6.2.2	Developers trained in secure software development	セキュア開発	13 件中 8 件
6.2.3	Custom code reviewed before release	セキュア開発, API セキュリティ	13 件中 8 件
6.2.3.1	Manual code reviews approved by someone else	—	0
6.2.4	Coding techniques prevent common software attacks	API セキュリティ	13 件中 4 件
6.3.1	Vulnerabilities identified and risk-ranked	脆弱性管理, 脅威インテリジェンス, パッチ管理	13 件中 13 件
6.3.2	Inventory of custom software and its components	サプライチェーンリスク, 資産管理	13 件中 13 件
6.3.3	Security patches installed promptly	パッチ管理	13 件中 10 件
6.4.1	Public web applications protected against attacks	Web セキュリティ	13 件中 6 件
6.4.2	Automated solution blocks attacks on public web apps	WAF	13 件中 5 件
6.4.3	Payment page scripts authorised and integrity-checked	Web セキュリティ	13 件中 6 件
6.5.1	Production changes follow change control procedures	—	なし
6.5.2	PCI DSS requirements re-confirmed after significant changes	—	なし
6.5.3	Pre-production environments separated from production	—	なし
6.5.4	Duties separated between production and pre-production	—	なし
6.5.5	Live PANs not used in pre-production	—	なし
6.5.6	Test data and accounts removed before go-live	—	なし
Requirement 7: Restrict access to system components and cardholder data by business need to know · 12
7.1.1	Access restriction policies documented and kept current	—	0
7.1.2	Roles for access restriction assigned	—	0
7.2.1	Access control model defined	アクセス制御, ゼロトラスト	13 件中 11 件
7.2.2	Access assigned by job function and least privilege	アクセス制御, 特権アクセス	13 件中 12 件
7.2.3	Privileges approved by authorised personnel	—	なし
7.2.4	User accounts and privileges reviewed every six months	アクセス制御	13 件中 11 件
7.2.5	System and application accounts least privilege	—	なし
7.2.5.1	System and application account access periodically reviewed	—	0
7.2.6	Access to cardholder data repositories restricted	—	なし
7.3.1	Access control system restricts access by need	—	なし
7.3.2	Access control system enforces assigned permissions	—	なし
7.3.3	Access control system set to deny by default	—	なし
Requirement 8: Identify users and authenticate access to system components · 29
8.1.1	Identification and authentication policies documented	—	0
8.1.2	Roles for identification and authentication assigned	—	0
8.2.1	Every user has a unique ID	アクセス制御	13 件中 11 件
8.2.2	Shared or generic accounts only by documented exception	—	0
8.2.3	Service providers use unique credentials per customer	—	なし
8.2.4	User ID changes authorised and controlled	—	なし
8.2.5	Access revoked immediately on termination	—	0
8.2.6	Inactive user accounts disabled within 90 days	—	0
8.2.7	Third-party remote access accounts enabled only when needed	—	なし
8.2.8	Re-authentication after 15 minutes idle	—	0
8.3.1	User and admin access requires an authentication factor	ゼロトラスト	13 件中 7 件
8.3.2	Authentication factors unreadable in transit and storage	—	なし
8.3.3	Identity verified before changing authentication factors	—	なし
8.3.4	Account lockout after repeated failed attempts	—	なし
8.3.5	First-use and reset passwords unique and changed	—	0
8.3.6	Minimum password length and complexity	—	0
8.3.7	Recent passwords cannot be reused	—	0
8.3.8	Authentication guidance communicated to users	—	0
8.3.9	Password-only access: change every 90 days or analyse risk	—	0
8.3.10	Service providers give customers password guidance	—	0
8.3.10.1	Service provider customer passwords: rotation or analysis	—	0
8.3.11	Tokens, smart cards and certificates assigned to individuals	—	なし
8.4.1	MFA for non-console administrative access to the CDE	多要素認証	13 件中 10 件
8.4.2	MFA for all access into the CDE	多要素認証	13 件中 10 件
8.4.3	MFA for remote network access	多要素認証	13 件中 10 件
8.5.1	MFA systems configured to resist misuse	多要素認証	13 件中 10 件
8.6.1	Interactive use of system accounts managed	—	なし
8.6.2	No hard-coded passwords for system accounts	—	0
8.6.3	System account passwords protected and changed	—	0
Requirement 9: Restrict physical access to cardholder data · 27
9.1.1	Physical security policies documented and kept current	—	0
9.1.2	Roles for physical security assigned	—	0
9.2.1	Facility entry controls restrict CDE access	物理的セキュリティ	13 件中 8 件
9.2.1.1	Access to sensitive areas monitored by camera or access control	物理的セキュリティ	13 件中 8 件
9.2.2	Publicly accessible network jacks restricted	—	なし
9.2.3	Physical access to network hardware restricted	物理的セキュリティ	13 件中 8 件
9.2.4	Consoles in sensitive areas locked when unattended	—	0
9.3.1	Personnel physical access authorised and managed	物理的セキュリティ	13 件中 8 件
9.3.1.1	Sensitive-area access authorised and revoked promptly	物理的セキュリティ	13 件中 8 件
9.3.2	Visitor access authorised, escorted and identifiable	物理的セキュリティ	13 件中 8 件
9.3.3	Visitor badges returned or deactivated	—	なし
9.3.4	Visitor log maintained and retained	—	なし
9.4.1	Media with cardholder data physically secured	—	なし
9.4.1.1	Offline backup media stored securely	バックアップと復旧	13 件中 11 件
9.4.1.2	Security of offline backup location reviewed annually	—	0
9.4.2	Media classified by data sensitivity	データ分類	13 件中 9 件
9.4.3	Media sent off site tracked and secured	—	なし
9.4.4	Management approves media moved off site	—	なし
9.4.5	Inventory logs of electronic media kept	—	なし
9.4.5.1	Electronic media inventories at least annually	—	なし
9.4.6	Hard-copy media destroyed when no longer needed	—	0
9.4.7	Electronic media destroyed or made unrecoverable	—	0
9.5.1	Card-reading (POI) devices protected from tampering	—	なし
9.5.1.1	Inventory of POI devices kept	—	0
9.5.1.2	POI devices inspected for tampering	—	0
9.5.1.2.1	Inspection frequency set by targeted risk analysis	—	0
9.5.1.3	Staff trained to spot POI tampering	—	なし
Requirement 10: Log and monitor all access to system components and cardholder data · 27
10.1.1	Logging and monitoring policies documented	—	0
10.1.2	Roles for logging and monitoring assigned	—	0
10.2.1	Audit logs enabled and active	ログ記録と監査, 内部脅威	13 件中 11 件
10.2.1.1	Logs capture user access to cardholder data	—	なし
10.2.1.2	Logs capture administrative actions	—	なし
10.2.1.3	Logs capture access to audit logs	—	なし
10.2.1.4	Logs capture invalid access attempts	—	なし
10.2.1.5	Logs capture credential and privilege changes	—	なし
10.2.1.6	Logs capture starting, stopping or pausing logging	—	なし
10.2.1.7	Logs capture system-level object changes	—	なし
10.2.2	Log entries record who, what, when, where and outcome	—	0
10.3.1	Read access to logs limited to need	—	0
10.3.2	Logs protected from modification	ログ記録と監査, フォレンジック	13 件中 10 件
10.3.3	Logs promptly backed up to a central server	—	0
10.3.4	File-integrity monitoring on logs	—	0
10.4.1	Security event and critical logs reviewed daily	継続的モニタリング, SIEM / SOC	13 件中 10 件
10.4.1.1	Automated mechanisms for log review	異常検知	13 件中 9 件
10.4.2	Other logs reviewed periodically	—	なし
10.4.2.1	Review frequency set by targeted risk analysis	—	0
10.4.3	Exceptions and anomalies addressed	—	なし
10.5.1	Audit logs retained 12 months, three immediately available	ログ記録と監査	13 件中 10 件
10.6.1	System clocks synchronised	ログ記録と監査	13 件中 10 件
10.6.2	Time configuration correct and consistent	—	なし
10.6.3	Time settings protected from change	—	0
10.7.1	Service providers detect security control failures	—	0
10.7.2	Critical security control failures detected and reported	—	0
10.7.3	Security control failures responded to promptly	—	なし
Requirement 11: Test security of systems and networks regularly · 21
11.1.1	Security testing policies documented and kept current	—	0
11.1.2	Roles for security testing assigned	—	0
11.2.1	Wireless access points detected and unauthorised ones handled	—	0
11.2.2	Inventory of authorised wireless access points	—	なし
11.3.1	Internal vulnerability scans every three months	脆弱性管理	13 件中 13 件
11.3.1.1	Lower-ranked vulnerabilities handled by risk analysis	—	0
11.3.1.2	Internal scans use authenticated scanning	—	なし
11.3.1.3	Internal scans after significant changes	—	なし
11.3.2	External ASV scans every three months	脆弱性管理	13 件中 13 件
11.3.2.1	External scans after significant changes	—	なし
11.4.1	Penetration testing methodology defined	—	なし
11.4.2	Internal penetration test at least annually	—	なし
11.4.3	External penetration test at least annually	—	なし
11.4.4	Penetration test findings corrected and retested	—	0
11.4.5	Segmentation controls tested at least annually	—	なし
11.4.6	Service providers test segmentation every six months	—	なし
11.4.7	Multi-tenant providers support customer penetration tests	—	なし
11.5.1	Intrusion detection or prevention on network traffic	侵入検知	13 件中 9 件
11.5.1.1	Service providers detect covert malware communication	—	なし
11.5.2	Change-detection on critical files	—	なし
11.6.1	Payment page changes and tampering detected	—	0
Requirement 12: Support information security with organizational policies and programs · 37
12.1.1	Information security policy established and published	ガバナンスポリシー	13 件中 9 件
12.1.2	Security policy reviewed at least annually	ガバナンスポリシー	13 件中 9 件
12.1.3	Security roles and responsibilities defined	役割と責任	13 件中 9 件
12.1.4	Executive responsibility for information security assigned	役割と責任	13 件中 9 件
12.2.1	Acceptable use policies for end-user technologies	—	なし
12.3.1	Targeted risk analysis for flexible-frequency requirements	リスクマネジメント, リスクアセスメント	13 件中 10 件
12.3.2	Targeted risk analysis for customised approach	—	0
12.3.3	Cipher suites and protocols reviewed annually	—	0
12.3.4	Hardware and software technologies reviewed annually	—	0
12.4.1	Service providers: executive responsibility for PCI DSS compliance	—	なし
12.4.2	Service providers: quarterly reviews of operational tasks	コンプライアンス	13 件中 10 件
12.4.2.1	Service providers: quarterly review results documented	—	0
12.5.1	Inventory of in-scope system components	資産管理	13 件中 13 件
12.5.2	PCI DSS scope confirmed annually and on change	事業環境	13 件中 5 件
12.5.2.1	Service providers confirm scope every six months	—	なし
12.5.3	Service providers review scope after organisational change	—	0
12.6.1	Formal security awareness programme	意識向上とトレーニング	13 件中 10 件
12.6.2	Awareness programme reviewed annually	—	なし
12.6.3	Awareness training on hire and at least annually	意識向上とトレーニング	13 件中 10 件
12.6.3.1	Training covers phishing and social engineering	—	なし
12.6.3.2	Training covers acceptable use of technology	—	なし
12.7.1	Personnel screened before hire	内部脅威	13 件中 8 件
12.8.1	List of third-party service providers kept	サプライチェーンリスク, クラウドセキュリティ, ベンダーリスク管理	13 件中 12 件
12.8.2	Written agreements with service providers	ベンダーリスク管理	13 件中 10 件
12.8.3	Due diligence before engaging service providers	ベンダーリスク管理	13 件中 10 件
12.8.4	Service provider compliance monitored annually	ベンダーリスク管理	13 件中 10 件
12.8.5	Responsibilities split with each provider documented	クラウドセキュリティ, ベンダーリスク管理	13 件中 12 件
12.9.1	Service providers acknowledge responsibilities to customers	—	0
12.9.2	Service providers support customer compliance requests	—	0
12.10.1	Incident response plan ready to activate	インシデント対応, 緩和策, 報告, 復旧計画, 事業継続, ディザスタリカバリ	13 件中 12 件
12.10.2	Incident response plan reviewed and tested annually	インシデント対応	13 件中 12 件
12.10.3	Incident response staff available around the clock	インシデント対応	13 件中 12 件
12.10.4	Incident response staff trained	インシデント対応	13 件中 12 件
12.10.4.1	Training frequency set by targeted risk analysis	—	0
12.10.5	Plan covers alerts from security monitoring	—	0
12.10.6	Plan updated from lessons learned and industry changes	教訓の反映	13 件中 9 件
12.10.7	Procedures for PAN found where it shouldn't be	—	0
Appendix A: additional requirements · 10
A1.1.1	Multi-tenant providers: separate provider and customer environments	—	なし
A1.1.2	Multi-tenant providers: customers confined to their own environment	—	なし
A1.1.3	Multi-tenant providers: customers reach only their own data	—	なし
A1.1.4	Multi-tenant providers: separation tested every six months	—	なし
A1.2.1	Multi-tenant providers: audit logging for each customer	—	なし
A1.2.2	Multi-tenant providers: support customer forensic investigations	—	なし
A1.2.3	Multi-tenant providers: report suspected incidents to customers	—	なし
A2.1.1	POI terminals using SSL or early TLS not exploitable	—	なし
A2.1.2	Service providers: migration plan off SSL and early TLS	—	なし
A2.1.3	Service providers offer a secure connection option	—	なし

トピックのカバレッジ

PCI DSSのマッピング済み要件を持つトピック（46件）:

当サイトのデータにはマッピングがありません PCI DSS の要件なし（4）: