PCI DSS v4.0.1

Сравнения

Требования

Идентификаторы и названия требований приведены так, как их публикует каждый фреймворк, на английском языке.

PCI DSS v4.0.1 требований

ID	Требование	Темы	Сопоставлено в
Requirement 1: Install and maintain network security controls · 19
1.1.1	Network security policies documented and kept current	—	0
1.1.2	Roles for network security controls assigned	—	0
1.2.1	Configuration standards for network security controls	Межсетевой экран / сегментация сети	9 из 13
1.2.2	Network connection changes go through change control	—	нет
1.2.3	Accurate network diagram maintained	Межсетевой экран / сегментация сети	9 из 13
1.2.4	Accurate account-data flow diagram maintained	—	0
1.2.5	Allowed services, protocols and ports approved	—	нет
1.2.6	Security features defined for insecure services	—	нет
1.2.7	Network security control rules reviewed every six months	—	нет
1.2.8	Network security control configuration files secured	—	нет
1.3.1	Inbound traffic to the CDE restricted	Межсетевой экран / сегментация сети	9 из 13
1.3.2	Outbound traffic from the CDE restricted	—	нет
1.3.3	Network controls between wireless networks and the CDE	—	нет
1.4.1	Network controls between trusted and untrusted networks	Межсетевой экран / сегментация сети	9 из 13
1.4.2	Inbound traffic from untrusted networks restricted	—	нет
1.4.3	Anti-spoofing measures in place	—	нет
1.4.4	Stored cardholder data not reachable from untrusted networks	—	нет
1.4.5	Internal IP addresses and routing not disclosed	—	нет
1.5.1	Controls on devices connecting to untrusted networks and the CDE	—	нет
Requirement 2: Apply secure configurations to all system components · 11
2.1.1	Secure configuration policies documented and kept current	—	0
2.1.2	Roles for secure configuration assigned	—	0
2.2.1	System configuration standards developed and maintained	Безопасная конфигурация	9 из 13
2.2.2	Vendor default accounts managed or removed	Безопасная конфигурация	9 из 13
2.2.3	Functions with different security levels kept apart	—	нет
2.2.4	Only necessary services and functions enabled	—	нет
2.2.5	Insecure services justified and secured	—	нет
2.2.6	System security parameters set to prevent misuse	—	нет
2.2.7	Non-console administrative access encrypted	—	нет
2.3.1	Wireless vendor defaults changed	—	0
2.3.2	Wireless keys changed when key holders leave	—	нет
Requirement 3: Protect stored account data · 29
3.1.1	Stored account data policies documented and kept current	—	0
3.1.2	Roles for protecting stored account data assigned	—	0
3.2.1	Account data storage minimised, with retention and disposal	Защита данных	11 из 13
3.3.1	Sensitive authentication data not kept after authorisation	Защита данных	11 из 13
3.3.1.1	Full track data not kept after authorisation	—	нет
3.3.1.2	Card verification code not kept after authorisation	—	нет
3.3.1.3	PIN and PIN block not kept after authorisation	—	нет
3.3.2	Sensitive authentication data encrypted before authorisation	—	нет
3.3.3	Issuer storage of sensitive authentication data limited and protected	—	нет
3.4.1	PAN masked when displayed	Защита данных	11 из 13
3.4.2	PAN copying prevented over remote-access technologies	DLP	7 из 13
3.5.1	PAN rendered unreadable wherever stored	Шифрование	10 из 13
3.5.1.1	Hashes of PAN are keyed cryptographic hashes	—	нет
3.5.1.2	Disk-level encryption used only where it suffices	—	нет
3.5.1.3	Disk encryption access managed separately from OS access	—	0
3.6.1	Procedures protect keys that secure stored account data	Шифрование	10 из 13
3.6.1.1	Service providers document their cryptographic architecture	—	0
3.6.1.2	Secret and private keys stored in approved forms	—	0
3.6.1.3	Cleartext key components accessible to fewest custodians	—	0
3.6.1.4	Keys stored in the fewest possible locations	—	0
3.7.1	Key management: strong key generation	Шифрование	10 из 13
3.7.2	Key management: secure key distribution	—	нет
3.7.3	Key management: secure key storage	—	нет
3.7.4	Key management: key changes at end of cryptoperiod	Шифрование	10 из 13
3.7.5	Key management: retiring weakened or compromised keys	—	нет
3.7.6	Key management: split knowledge and dual control	—	нет
3.7.7	Key management: preventing unauthorised key substitution	—	нет
3.7.8	Key custodians formally acknowledge their responsibilities	—	нет
3.7.9	Service providers give customers key-handling guidance	—	нет
Requirement 4: Protect cardholder data with strong cryptography during transmission · 6
4.1.1	Data-in-transit policies documented and kept current	—	0
4.1.2	Roles for protecting data in transit assigned	—	0
4.2.1	Strong cryptography for PAN over open, public networks	Шифрование	10 из 13
4.2.1.1	Inventory of trusted keys and certificates kept	Шифрование	10 из 13
4.2.1.2	Strong cryptography on wireless networks carrying PAN	—	нет
4.2.2	PAN secured when sent by end-user messaging	—	нет
Requirement 5: Protect all systems and networks from malicious software · 13
5.1.1	Anti-malware policies documented and kept current	—	0
5.1.2	Roles for malware protection assigned	—	0
5.2.1	Anti-malware deployed on system components	Защита конечных точек	10 из 13
5.2.2	Anti-malware detects, removes or contains known malware	Защита конечных точек	10 из 13
5.2.3	Systems without anti-malware periodically re-evaluated	—	0
5.2.3.1	Re-evaluation frequency set by targeted risk analysis	—	0
5.3.1	Anti-malware kept up to date	—	нет
5.3.2	Periodic scans or continuous behavioural analysis	Защита конечных точек	10 из 13
5.3.2.1	Scan frequency set by targeted risk analysis	—	0
5.3.3	Removable media scanned or analysed	—	нет
5.3.4	Anti-malware audit logs enabled and retained	—	нет
5.3.5	Users cannot disable or alter anti-malware	—	нет
5.4.1	Mechanisms to detect and protect against phishing	Безопасность электронной почты	8 из 13
Requirement 6: Develop and maintain secure systems and software · 19
6.1.1	Secure systems and software policies documented	—	0
6.1.2	Roles for secure systems and software assigned	—	0
6.2.1	Bespoke and custom software developed securely	Безопасная разработка	8 из 13
6.2.2	Developers trained in secure software development	Безопасная разработка	8 из 13
6.2.3	Custom code reviewed before release	Безопасная разработка, Безопасность API	8 из 13
6.2.3.1	Manual code reviews approved by someone else	—	0
6.2.4	Coding techniques prevent common software attacks	Безопасность API	4 из 13
6.3.1	Vulnerabilities identified and risk-ranked	Управление уязвимостями, Разведка угроз, Управление исправлениями	13 из 13
6.3.2	Inventory of custom software and its components	Управление рисками цепочки поставок, Управление активами	13 из 13
6.3.3	Security patches installed promptly	Управление исправлениями	10 из 13
6.4.1	Public web applications protected against attacks	Безопасность веб-приложений	6 из 13
6.4.2	Automated solution blocks attacks on public web apps	WAF	5 из 13
6.4.3	Payment page scripts authorised and integrity-checked	Безопасность веб-приложений	6 из 13
6.5.1	Production changes follow change control procedures	—	нет
6.5.2	PCI DSS requirements re-confirmed after significant changes	—	нет
6.5.3	Pre-production environments separated from production	—	нет
6.5.4	Duties separated between production and pre-production	—	нет
6.5.5	Live PANs not used in pre-production	—	нет
6.5.6	Test data and accounts removed before go-live	—	нет
Requirement 7: Restrict access to system components and cardholder data by business need to know · 12
7.1.1	Access restriction policies documented and kept current	—	0
7.1.2	Roles for access restriction assigned	—	0
7.2.1	Access control model defined	Контроль доступа, Нулевое доверие	11 из 13
7.2.2	Access assigned by job function and least privilege	Контроль доступа, Привилегированный доступ	12 из 13
7.2.3	Privileges approved by authorised personnel	—	нет
7.2.4	User accounts and privileges reviewed every six months	Контроль доступа	11 из 13
7.2.5	System and application accounts least privilege	—	нет
7.2.5.1	System and application account access periodically reviewed	—	0
7.2.6	Access to cardholder data repositories restricted	—	нет
7.3.1	Access control system restricts access by need	—	нет
7.3.2	Access control system enforces assigned permissions	—	нет
7.3.3	Access control system set to deny by default	—	нет
Requirement 8: Identify users and authenticate access to system components · 29
8.1.1	Identification and authentication policies documented	—	0
8.1.2	Roles for identification and authentication assigned	—	0
8.2.1	Every user has a unique ID	Контроль доступа	11 из 13
8.2.2	Shared or generic accounts only by documented exception	—	0
8.2.3	Service providers use unique credentials per customer	—	нет
8.2.4	User ID changes authorised and controlled	—	нет
8.2.5	Access revoked immediately on termination	—	0
8.2.6	Inactive user accounts disabled within 90 days	—	0
8.2.7	Third-party remote access accounts enabled only when needed	—	нет
8.2.8	Re-authentication after 15 minutes idle	—	0
8.3.1	User and admin access requires an authentication factor	Нулевое доверие	7 из 13
8.3.2	Authentication factors unreadable in transit and storage	—	нет
8.3.3	Identity verified before changing authentication factors	—	нет
8.3.4	Account lockout after repeated failed attempts	—	нет
8.3.5	First-use and reset passwords unique and changed	—	0
8.3.6	Minimum password length and complexity	—	0
8.3.7	Recent passwords cannot be reused	—	0
8.3.8	Authentication guidance communicated to users	—	0
8.3.9	Password-only access: change every 90 days or analyse risk	—	0
8.3.10	Service providers give customers password guidance	—	0
8.3.10.1	Service provider customer passwords: rotation or analysis	—	0
8.3.11	Tokens, smart cards and certificates assigned to individuals	—	нет
8.4.1	MFA for non-console administrative access to the CDE	Многофакторная аутентификация	10 из 13
8.4.2	MFA for all access into the CDE	Многофакторная аутентификация	10 из 13
8.4.3	MFA for remote network access	Многофакторная аутентификация	10 из 13
8.5.1	MFA systems configured to resist misuse	Многофакторная аутентификация	10 из 13
8.6.1	Interactive use of system accounts managed	—	нет
8.6.2	No hard-coded passwords for system accounts	—	0
8.6.3	System account passwords protected and changed	—	0
Requirement 9: Restrict physical access to cardholder data · 27
9.1.1	Physical security policies documented and kept current	—	0
9.1.2	Roles for physical security assigned	—	0
9.2.1	Facility entry controls restrict CDE access	Физическая безопасность	8 из 13
9.2.1.1	Access to sensitive areas monitored by camera or access control	Физическая безопасность	8 из 13
9.2.2	Publicly accessible network jacks restricted	—	нет
9.2.3	Physical access to network hardware restricted	Физическая безопасность	8 из 13
9.2.4	Consoles in sensitive areas locked when unattended	—	0
9.3.1	Personnel physical access authorised and managed	Физическая безопасность	8 из 13
9.3.1.1	Sensitive-area access authorised and revoked promptly	Физическая безопасность	8 из 13
9.3.2	Visitor access authorised, escorted and identifiable	Физическая безопасность	8 из 13
9.3.3	Visitor badges returned or deactivated	—	нет
9.3.4	Visitor log maintained and retained	—	нет
9.4.1	Media with cardholder data physically secured	—	нет
9.4.1.1	Offline backup media stored securely	Резервное копирование и восстановление	11 из 13
9.4.1.2	Security of offline backup location reviewed annually	—	0
9.4.2	Media classified by data sensitivity	Классификация данных	9 из 13
9.4.3	Media sent off site tracked and secured	—	нет
9.4.4	Management approves media moved off site	—	нет
9.4.5	Inventory logs of electronic media kept	—	нет
9.4.5.1	Electronic media inventories at least annually	—	нет
9.4.6	Hard-copy media destroyed when no longer needed	—	0
9.4.7	Electronic media destroyed or made unrecoverable	—	0
9.5.1	Card-reading (POI) devices protected from tampering	—	нет
9.5.1.1	Inventory of POI devices kept	—	0
9.5.1.2	POI devices inspected for tampering	—	0
9.5.1.2.1	Inspection frequency set by targeted risk analysis	—	0
9.5.1.3	Staff trained to spot POI tampering	—	нет
Requirement 10: Log and monitor all access to system components and cardholder data · 27
10.1.1	Logging and monitoring policies documented	—	0
10.1.2	Roles for logging and monitoring assigned	—	0
10.2.1	Audit logs enabled and active	Логирование и аудит, Внутренние угрозы	11 из 13
10.2.1.1	Logs capture user access to cardholder data	—	нет
10.2.1.2	Logs capture administrative actions	—	нет
10.2.1.3	Logs capture access to audit logs	—	нет
10.2.1.4	Logs capture invalid access attempts	—	нет
10.2.1.5	Logs capture credential and privilege changes	—	нет
10.2.1.6	Logs capture starting, stopping or pausing logging	—	нет
10.2.1.7	Logs capture system-level object changes	—	нет
10.2.2	Log entries record who, what, when, where and outcome	—	0
10.3.1	Read access to logs limited to need	—	0
10.3.2	Logs protected from modification	Логирование и аудит, Криминалистический анализ	10 из 13
10.3.3	Logs promptly backed up to a central server	—	0
10.3.4	File-integrity monitoring on logs	—	0
10.4.1	Security event and critical logs reviewed daily	Непрерывный мониторинг, SIEM / SOC	10 из 13
10.4.1.1	Automated mechanisms for log review	Обнаружение аномалий	9 из 13
10.4.2	Other logs reviewed periodically	—	нет
10.4.2.1	Review frequency set by targeted risk analysis	—	0
10.4.3	Exceptions and anomalies addressed	—	нет
10.5.1	Audit logs retained 12 months, three immediately available	Логирование и аудит	10 из 13
10.6.1	System clocks synchronised	Логирование и аудит	10 из 13
10.6.2	Time configuration correct and consistent	—	нет
10.6.3	Time settings protected from change	—	0
10.7.1	Service providers detect security control failures	—	0
10.7.2	Critical security control failures detected and reported	—	0
10.7.3	Security control failures responded to promptly	—	нет
Requirement 11: Test security of systems and networks regularly · 21
11.1.1	Security testing policies documented and kept current	—	0
11.1.2	Roles for security testing assigned	—	0
11.2.1	Wireless access points detected and unauthorised ones handled	—	0
11.2.2	Inventory of authorised wireless access points	—	нет
11.3.1	Internal vulnerability scans every three months	Управление уязвимостями	13 из 13
11.3.1.1	Lower-ranked vulnerabilities handled by risk analysis	—	0
11.3.1.2	Internal scans use authenticated scanning	—	нет
11.3.1.3	Internal scans after significant changes	—	нет
11.3.2	External ASV scans every three months	Управление уязвимостями	13 из 13
11.3.2.1	External scans after significant changes	—	нет
11.4.1	Penetration testing methodology defined	—	нет
11.4.2	Internal penetration test at least annually	—	нет
11.4.3	External penetration test at least annually	—	нет
11.4.4	Penetration test findings corrected and retested	—	0
11.4.5	Segmentation controls tested at least annually	—	нет
11.4.6	Service providers test segmentation every six months	—	нет
11.4.7	Multi-tenant providers support customer penetration tests	—	нет
11.5.1	Intrusion detection or prevention on network traffic	Обнаружение вторжений	9 из 13
11.5.1.1	Service providers detect covert malware communication	—	нет
11.5.2	Change-detection on critical files	—	нет
11.6.1	Payment page changes and tampering detected	—	0
Requirement 12: Support information security with organizational policies and programs · 37
12.1.1	Information security policy established and published	Политика управления	9 из 13
12.1.2	Security policy reviewed at least annually	Политика управления	9 из 13
12.1.3	Security roles and responsibilities defined	Роли и обязанности	9 из 13
12.1.4	Executive responsibility for information security assigned	Роли и обязанности	9 из 13
12.2.1	Acceptable use policies for end-user technologies	—	нет
12.3.1	Targeted risk analysis for flexible-frequency requirements	Управление рисками, Оценка рисков	10 из 13
12.3.2	Targeted risk analysis for customised approach	—	0
12.3.3	Cipher suites and protocols reviewed annually	—	0
12.3.4	Hardware and software technologies reviewed annually	—	0
12.4.1	Service providers: executive responsibility for PCI DSS compliance	—	нет
12.4.2	Service providers: quarterly reviews of operational tasks	Соответствие требованиям	10 из 13
12.4.2.1	Service providers: quarterly review results documented	—	0
12.5.1	Inventory of in-scope system components	Управление активами	13 из 13
12.5.2	PCI DSS scope confirmed annually and on change	Бизнес-среда	5 из 13
12.5.2.1	Service providers confirm scope every six months	—	нет
12.5.3	Service providers review scope after organisational change	—	0
12.6.1	Formal security awareness programme	Осведомлённость и обучение	10 из 13
12.6.2	Awareness programme reviewed annually	—	нет
12.6.3	Awareness training on hire and at least annually	Осведомлённость и обучение	10 из 13
12.6.3.1	Training covers phishing and social engineering	—	нет
12.6.3.2	Training covers acceptable use of technology	—	нет
12.7.1	Personnel screened before hire	Внутренние угрозы	8 из 13
12.8.1	List of third-party service providers kept	Управление рисками цепочки поставок, Безопасность облачных сред, Управление рисками поставщиков	12 из 13
12.8.2	Written agreements with service providers	Управление рисками поставщиков	10 из 13
12.8.3	Due diligence before engaging service providers	Управление рисками поставщиков	10 из 13
12.8.4	Service provider compliance monitored annually	Управление рисками поставщиков	10 из 13
12.8.5	Responsibilities split with each provider documented	Безопасность облачных сред, Управление рисками поставщиков	12 из 13
12.9.1	Service providers acknowledge responsibilities to customers	—	0
12.9.2	Service providers support customer compliance requests	—	0
12.10.1	Incident response plan ready to activate	Реагирование на инциденты, Митигация, Отчётность, Планирование восстановления, Непрерывность бизнеса, Аварийное восстановление	12 из 13
12.10.2	Incident response plan reviewed and tested annually	Реагирование на инциденты	12 из 13
12.10.3	Incident response staff available around the clock	Реагирование на инциденты	12 из 13
12.10.4	Incident response staff trained	Реагирование на инциденты	12 из 13
12.10.4.1	Training frequency set by targeted risk analysis	—	0
12.10.5	Plan covers alerts from security monitoring	—	0
12.10.6	Plan updated from lessons learned and industry changes	Извлечённые уроки	9 из 13
12.10.7	Procedures for PAN found where it shouldn't be	—	0
Appendix A: additional requirements · 10
A1.1.1	Multi-tenant providers: separate provider and customer environments	—	нет
A1.1.2	Multi-tenant providers: customers confined to their own environment	—	нет
A1.1.3	Multi-tenant providers: customers reach only their own data	—	нет
A1.1.4	Multi-tenant providers: separation tested every six months	—	нет
A1.2.1	Multi-tenant providers: audit logging for each customer	—	нет
A1.2.2	Multi-tenant providers: support customer forensic investigations	—	нет
A1.2.3	Multi-tenant providers: report suspected incidents to customers	—	нет
A2.1.1	POI terminals using SSL or early TLS not exploitable	—	нет
A2.1.2	Service providers: migration plan off SSL and early TLS	—	нет
A2.1.3	Service providers offer a secure connection option	—	нет

Охват темы

Темы с сопоставленными требованиями PCI DSS (46):

Нет сопоставления в наших данных Нет требования PCI DSS (4):