PCI DSS v4.0.1

비교 자료

요구사항

요구사항 ID와 제목은 각 프레임워크가 발표한 그대로 영문으로 표시됩니다.

PCI DSS v4.0.1 요구사항

ID	요구사항	주제	매핑 위치:
Requirement 1: Install and maintain network security controls · 19
1.1.1	Network security policies documented and kept current	—	0
1.1.2	Roles for network security controls assigned	—	0
1.2.1	Configuration standards for network security controls	방화벽 / 네트워크 분리	9 / 13
1.2.2	Network connection changes go through change control	—	없음
1.2.3	Accurate network diagram maintained	방화벽 / 네트워크 분리	9 / 13
1.2.4	Accurate account-data flow diagram maintained	—	0
1.2.5	Allowed services, protocols and ports approved	—	없음
1.2.6	Security features defined for insecure services	—	없음
1.2.7	Network security control rules reviewed every six months	—	없음
1.2.8	Network security control configuration files secured	—	없음
1.3.1	Inbound traffic to the CDE restricted	방화벽 / 네트워크 분리	9 / 13
1.3.2	Outbound traffic from the CDE restricted	—	없음
1.3.3	Network controls between wireless networks and the CDE	—	없음
1.4.1	Network controls between trusted and untrusted networks	방화벽 / 네트워크 분리	9 / 13
1.4.2	Inbound traffic from untrusted networks restricted	—	없음
1.4.3	Anti-spoofing measures in place	—	없음
1.4.4	Stored cardholder data not reachable from untrusted networks	—	없음
1.4.5	Internal IP addresses and routing not disclosed	—	없음
1.5.1	Controls on devices connecting to untrusted networks and the CDE	—	없음
Requirement 2: Apply secure configurations to all system components · 11
2.1.1	Secure configuration policies documented and kept current	—	0
2.1.2	Roles for secure configuration assigned	—	0
2.2.1	System configuration standards developed and maintained	보안 구성	9 / 13
2.2.2	Vendor default accounts managed or removed	보안 구성	9 / 13
2.2.3	Functions with different security levels kept apart	—	없음
2.2.4	Only necessary services and functions enabled	—	없음
2.2.5	Insecure services justified and secured	—	없음
2.2.6	System security parameters set to prevent misuse	—	없음
2.2.7	Non-console administrative access encrypted	—	없음
2.3.1	Wireless vendor defaults changed	—	0
2.3.2	Wireless keys changed when key holders leave	—	없음
Requirement 3: Protect stored account data · 29
3.1.1	Stored account data policies documented and kept current	—	0
3.1.2	Roles for protecting stored account data assigned	—	0
3.2.1	Account data storage minimised, with retention and disposal	데이터 보호	11 / 13
3.3.1	Sensitive authentication data not kept after authorisation	데이터 보호	11 / 13
3.3.1.1	Full track data not kept after authorisation	—	없음
3.3.1.2	Card verification code not kept after authorisation	—	없음
3.3.1.3	PIN and PIN block not kept after authorisation	—	없음
3.3.2	Sensitive authentication data encrypted before authorisation	—	없음
3.3.3	Issuer storage of sensitive authentication data limited and protected	—	없음
3.4.1	PAN masked when displayed	데이터 보호	11 / 13
3.4.2	PAN copying prevented over remote-access technologies	DLP	7 / 13
3.5.1	PAN rendered unreadable wherever stored	암호화	10 / 13
3.5.1.1	Hashes of PAN are keyed cryptographic hashes	—	없음
3.5.1.2	Disk-level encryption used only where it suffices	—	없음
3.5.1.3	Disk encryption access managed separately from OS access	—	0
3.6.1	Procedures protect keys that secure stored account data	암호화	10 / 13
3.6.1.1	Service providers document their cryptographic architecture	—	0
3.6.1.2	Secret and private keys stored in approved forms	—	0
3.6.1.3	Cleartext key components accessible to fewest custodians	—	0
3.6.1.4	Keys stored in the fewest possible locations	—	0
3.7.1	Key management: strong key generation	암호화	10 / 13
3.7.2	Key management: secure key distribution	—	없음
3.7.3	Key management: secure key storage	—	없음
3.7.4	Key management: key changes at end of cryptoperiod	암호화	10 / 13
3.7.5	Key management: retiring weakened or compromised keys	—	없음
3.7.6	Key management: split knowledge and dual control	—	없음
3.7.7	Key management: preventing unauthorised key substitution	—	없음
3.7.8	Key custodians formally acknowledge their responsibilities	—	없음
3.7.9	Service providers give customers key-handling guidance	—	없음
Requirement 4: Protect cardholder data with strong cryptography during transmission · 6
4.1.1	Data-in-transit policies documented and kept current	—	0
4.1.2	Roles for protecting data in transit assigned	—	0
4.2.1	Strong cryptography for PAN over open, public networks	암호화	10 / 13
4.2.1.1	Inventory of trusted keys and certificates kept	암호화	10 / 13
4.2.1.2	Strong cryptography on wireless networks carrying PAN	—	없음
4.2.2	PAN secured when sent by end-user messaging	—	없음
Requirement 5: Protect all systems and networks from malicious software · 13
5.1.1	Anti-malware policies documented and kept current	—	0
5.1.2	Roles for malware protection assigned	—	0
5.2.1	Anti-malware deployed on system components	엔드포인트 보호	10 / 13
5.2.2	Anti-malware detects, removes or contains known malware	엔드포인트 보호	10 / 13
5.2.3	Systems without anti-malware periodically re-evaluated	—	0
5.2.3.1	Re-evaluation frequency set by targeted risk analysis	—	0
5.3.1	Anti-malware kept up to date	—	없음
5.3.2	Periodic scans or continuous behavioural analysis	엔드포인트 보호	10 / 13
5.3.2.1	Scan frequency set by targeted risk analysis	—	0
5.3.3	Removable media scanned or analysed	—	없음
5.3.4	Anti-malware audit logs enabled and retained	—	없음
5.3.5	Users cannot disable or alter anti-malware	—	없음
5.4.1	Mechanisms to detect and protect against phishing	이메일 보안	8 / 13
Requirement 6: Develop and maintain secure systems and software · 19
6.1.1	Secure systems and software policies documented	—	0
6.1.2	Roles for secure systems and software assigned	—	0
6.2.1	Bespoke and custom software developed securely	보안 개발	8 / 13
6.2.2	Developers trained in secure software development	보안 개발	8 / 13
6.2.3	Custom code reviewed before release	보안 개발, API 보안	8 / 13
6.2.3.1	Manual code reviews approved by someone else	—	0
6.2.4	Coding techniques prevent common software attacks	API 보안	4 / 13
6.3.1	Vulnerabilities identified and risk-ranked	취약점 관리, 위협 인텔리전스, 패치 관리	13 / 13
6.3.2	Inventory of custom software and its components	공급망 위험, 자산 관리	13 / 13
6.3.3	Security patches installed promptly	패치 관리	10 / 13
6.4.1	Public web applications protected against attacks	웹 보안	6 / 13
6.4.2	Automated solution blocks attacks on public web apps	WAF	5 / 13
6.4.3	Payment page scripts authorised and integrity-checked	웹 보안	6 / 13
6.5.1	Production changes follow change control procedures	—	없음
6.5.2	PCI DSS requirements re-confirmed after significant changes	—	없음
6.5.3	Pre-production environments separated from production	—	없음
6.5.4	Duties separated between production and pre-production	—	없음
6.5.5	Live PANs not used in pre-production	—	없음
6.5.6	Test data and accounts removed before go-live	—	없음
Requirement 7: Restrict access to system components and cardholder data by business need to know · 12
7.1.1	Access restriction policies documented and kept current	—	0
7.1.2	Roles for access restriction assigned	—	0
7.2.1	Access control model defined	접근 통제, 제로 트러스트	11 / 13
7.2.2	Access assigned by job function and least privilege	접근 통제, 특권 접근	12 / 13
7.2.3	Privileges approved by authorised personnel	—	없음
7.2.4	User accounts and privileges reviewed every six months	접근 통제	11 / 13
7.2.5	System and application accounts least privilege	—	없음
7.2.5.1	System and application account access periodically reviewed	—	0
7.2.6	Access to cardholder data repositories restricted	—	없음
7.3.1	Access control system restricts access by need	—	없음
7.3.2	Access control system enforces assigned permissions	—	없음
7.3.3	Access control system set to deny by default	—	없음
Requirement 8: Identify users and authenticate access to system components · 29
8.1.1	Identification and authentication policies documented	—	0
8.1.2	Roles for identification and authentication assigned	—	0
8.2.1	Every user has a unique ID	접근 통제	11 / 13
8.2.2	Shared or generic accounts only by documented exception	—	0
8.2.3	Service providers use unique credentials per customer	—	없음
8.2.4	User ID changes authorised and controlled	—	없음
8.2.5	Access revoked immediately on termination	—	0
8.2.6	Inactive user accounts disabled within 90 days	—	0
8.2.7	Third-party remote access accounts enabled only when needed	—	없음
8.2.8	Re-authentication after 15 minutes idle	—	0
8.3.1	User and admin access requires an authentication factor	제로 트러스트	7 / 13
8.3.2	Authentication factors unreadable in transit and storage	—	없음
8.3.3	Identity verified before changing authentication factors	—	없음
8.3.4	Account lockout after repeated failed attempts	—	없음
8.3.5	First-use and reset passwords unique and changed	—	0
8.3.6	Minimum password length and complexity	—	0
8.3.7	Recent passwords cannot be reused	—	0
8.3.8	Authentication guidance communicated to users	—	0
8.3.9	Password-only access: change every 90 days or analyse risk	—	0
8.3.10	Service providers give customers password guidance	—	0
8.3.10.1	Service provider customer passwords: rotation or analysis	—	0
8.3.11	Tokens, smart cards and certificates assigned to individuals	—	없음
8.4.1	MFA for non-console administrative access to the CDE	다단계 인증	10 / 13
8.4.2	MFA for all access into the CDE	다단계 인증	10 / 13
8.4.3	MFA for remote network access	다단계 인증	10 / 13
8.5.1	MFA systems configured to resist misuse	다단계 인증	10 / 13
8.6.1	Interactive use of system accounts managed	—	없음
8.6.2	No hard-coded passwords for system accounts	—	0
8.6.3	System account passwords protected and changed	—	0
Requirement 9: Restrict physical access to cardholder data · 27
9.1.1	Physical security policies documented and kept current	—	0
9.1.2	Roles for physical security assigned	—	0
9.2.1	Facility entry controls restrict CDE access	물리적 보안	8 / 13
9.2.1.1	Access to sensitive areas monitored by camera or access control	물리적 보안	8 / 13
9.2.2	Publicly accessible network jacks restricted	—	없음
9.2.3	Physical access to network hardware restricted	물리적 보안	8 / 13
9.2.4	Consoles in sensitive areas locked when unattended	—	0
9.3.1	Personnel physical access authorised and managed	물리적 보안	8 / 13
9.3.1.1	Sensitive-area access authorised and revoked promptly	물리적 보안	8 / 13
9.3.2	Visitor access authorised, escorted and identifiable	물리적 보안	8 / 13
9.3.3	Visitor badges returned or deactivated	—	없음
9.3.4	Visitor log maintained and retained	—	없음
9.4.1	Media with cardholder data physically secured	—	없음
9.4.1.1	Offline backup media stored securely	백업 및 복구	11 / 13
9.4.1.2	Security of offline backup location reviewed annually	—	0
9.4.2	Media classified by data sensitivity	데이터 분류	9 / 13
9.4.3	Media sent off site tracked and secured	—	없음
9.4.4	Management approves media moved off site	—	없음
9.4.5	Inventory logs of electronic media kept	—	없음
9.4.5.1	Electronic media inventories at least annually	—	없음
9.4.6	Hard-copy media destroyed when no longer needed	—	0
9.4.7	Electronic media destroyed or made unrecoverable	—	0
9.5.1	Card-reading (POI) devices protected from tampering	—	없음
9.5.1.1	Inventory of POI devices kept	—	0
9.5.1.2	POI devices inspected for tampering	—	0
9.5.1.2.1	Inspection frequency set by targeted risk analysis	—	0
9.5.1.3	Staff trained to spot POI tampering	—	없음
Requirement 10: Log and monitor all access to system components and cardholder data · 27
10.1.1	Logging and monitoring policies documented	—	0
10.1.2	Roles for logging and monitoring assigned	—	0
10.2.1	Audit logs enabled and active	로깅 및 감사, 내부자 위협	11 / 13
10.2.1.1	Logs capture user access to cardholder data	—	없음
10.2.1.2	Logs capture administrative actions	—	없음
10.2.1.3	Logs capture access to audit logs	—	없음
10.2.1.4	Logs capture invalid access attempts	—	없음
10.2.1.5	Logs capture credential and privilege changes	—	없음
10.2.1.6	Logs capture starting, stopping or pausing logging	—	없음
10.2.1.7	Logs capture system-level object changes	—	없음
10.2.2	Log entries record who, what, when, where and outcome	—	0
10.3.1	Read access to logs limited to need	—	0
10.3.2	Logs protected from modification	로깅 및 감사, 포렌식	10 / 13
10.3.3	Logs promptly backed up to a central server	—	0
10.3.4	File-integrity monitoring on logs	—	0
10.4.1	Security event and critical logs reviewed daily	지속적 모니터링, SIEM / SOC	10 / 13
10.4.1.1	Automated mechanisms for log review	이상 징후 탐지	9 / 13
10.4.2	Other logs reviewed periodically	—	없음
10.4.2.1	Review frequency set by targeted risk analysis	—	0
10.4.3	Exceptions and anomalies addressed	—	없음
10.5.1	Audit logs retained 12 months, three immediately available	로깅 및 감사	10 / 13
10.6.1	System clocks synchronised	로깅 및 감사	10 / 13
10.6.2	Time configuration correct and consistent	—	없음
10.6.3	Time settings protected from change	—	0
10.7.1	Service providers detect security control failures	—	0
10.7.2	Critical security control failures detected and reported	—	0
10.7.3	Security control failures responded to promptly	—	없음
Requirement 11: Test security of systems and networks regularly · 21
11.1.1	Security testing policies documented and kept current	—	0
11.1.2	Roles for security testing assigned	—	0
11.2.1	Wireless access points detected and unauthorised ones handled	—	0
11.2.2	Inventory of authorised wireless access points	—	없음
11.3.1	Internal vulnerability scans every three months	취약점 관리	13 / 13
11.3.1.1	Lower-ranked vulnerabilities handled by risk analysis	—	0
11.3.1.2	Internal scans use authenticated scanning	—	없음
11.3.1.3	Internal scans after significant changes	—	없음
11.3.2	External ASV scans every three months	취약점 관리	13 / 13
11.3.2.1	External scans after significant changes	—	없음
11.4.1	Penetration testing methodology defined	—	없음
11.4.2	Internal penetration test at least annually	—	없음
11.4.3	External penetration test at least annually	—	없음
11.4.4	Penetration test findings corrected and retested	—	0
11.4.5	Segmentation controls tested at least annually	—	없음
11.4.6	Service providers test segmentation every six months	—	없음
11.4.7	Multi-tenant providers support customer penetration tests	—	없음
11.5.1	Intrusion detection or prevention on network traffic	침입 탐지	9 / 13
11.5.1.1	Service providers detect covert malware communication	—	없음
11.5.2	Change-detection on critical files	—	없음
11.6.1	Payment page changes and tampering detected	—	0
Requirement 12: Support information security with organizational policies and programs · 37
12.1.1	Information security policy established and published	거버넌스 정책	9 / 13
12.1.2	Security policy reviewed at least annually	거버넌스 정책	9 / 13
12.1.3	Security roles and responsibilities defined	역할 및 책임	9 / 13
12.1.4	Executive responsibility for information security assigned	역할 및 책임	9 / 13
12.2.1	Acceptable use policies for end-user technologies	—	없음
12.3.1	Targeted risk analysis for flexible-frequency requirements	위험 관리, 위험 평가	10 / 13
12.3.2	Targeted risk analysis for customised approach	—	0
12.3.3	Cipher suites and protocols reviewed annually	—	0
12.3.4	Hardware and software technologies reviewed annually	—	0
12.4.1	Service providers: executive responsibility for PCI DSS compliance	—	없음
12.4.2	Service providers: quarterly reviews of operational tasks	컴플라이언스	10 / 13
12.4.2.1	Service providers: quarterly review results documented	—	0
12.5.1	Inventory of in-scope system components	자산 관리	13 / 13
12.5.2	PCI DSS scope confirmed annually and on change	사업 환경	5 / 13
12.5.2.1	Service providers confirm scope every six months	—	없음
12.5.3	Service providers review scope after organisational change	—	0
12.6.1	Formal security awareness programme	인식 제고 및 교육	10 / 13
12.6.2	Awareness programme reviewed annually	—	없음
12.6.3	Awareness training on hire and at least annually	인식 제고 및 교육	10 / 13
12.6.3.1	Training covers phishing and social engineering	—	없음
12.6.3.2	Training covers acceptable use of technology	—	없음
12.7.1	Personnel screened before hire	내부자 위협	8 / 13
12.8.1	List of third-party service providers kept	공급망 위험, 클라우드 보안, 벤더 리스크 관리	12 / 13
12.8.2	Written agreements with service providers	벤더 리스크 관리	10 / 13
12.8.3	Due diligence before engaging service providers	벤더 리스크 관리	10 / 13
12.8.4	Service provider compliance monitored annually	벤더 리스크 관리	10 / 13
12.8.5	Responsibilities split with each provider documented	클라우드 보안, 벤더 리스크 관리	12 / 13
12.9.1	Service providers acknowledge responsibilities to customers	—	0
12.9.2	Service providers support customer compliance requests	—	0
12.10.1	Incident response plan ready to activate	사고 대응, 완화, 보고, 복구 계획 수립, 비즈니스 연속성, 재해 복구	12 / 13
12.10.2	Incident response plan reviewed and tested annually	사고 대응	12 / 13
12.10.3	Incident response staff available around the clock	사고 대응	12 / 13
12.10.4	Incident response staff trained	사고 대응	12 / 13
12.10.4.1	Training frequency set by targeted risk analysis	—	0
12.10.5	Plan covers alerts from security monitoring	—	0
12.10.6	Plan updated from lessons learned and industry changes	교훈 도출	9 / 13
12.10.7	Procedures for PAN found where it shouldn't be	—	0
Appendix A: additional requirements · 10
A1.1.1	Multi-tenant providers: separate provider and customer environments	—	없음
A1.1.2	Multi-tenant providers: customers confined to their own environment	—	없음
A1.1.3	Multi-tenant providers: customers reach only their own data	—	없음
A1.1.4	Multi-tenant providers: separation tested every six months	—	없음
A1.2.1	Multi-tenant providers: audit logging for each customer	—	없음
A1.2.2	Multi-tenant providers: support customer forensic investigations	—	없음
A1.2.3	Multi-tenant providers: report suspected incidents to customers	—	없음
A2.1.1	POI terminals using SSL or early TLS not exploitable	—	없음
A2.1.2	Service providers: migration plan off SSL and early TLS	—	없음
A2.1.3	Service providers offer a secure connection option	—	없음

주제 커버리지

PCI DSS 요구사항과 매핑된 주제 (46개):

보유 데이터에 매핑 없음 PCI DSS 요구사항 없음 (4):