PCI DSS v4.0.1

对比分析

要求

要求编号和标题均按各框架官方发布的英文原文显示。

PCI DSS v4.0.1 项要求

ID	要求	主题	映射于
Requirement 1: Install and maintain network security controls · 19
1.1.1	Network security policies documented and kept current	—	0
1.1.2	Roles for network security controls assigned	—	0
1.2.1	Configuration standards for network security controls	防火墙 / 网络分段	9 / 13
1.2.2	Network connection changes go through change control	—	无
1.2.3	Accurate network diagram maintained	防火墙 / 网络分段	9 / 13
1.2.4	Accurate account-data flow diagram maintained	—	0
1.2.5	Allowed services, protocols and ports approved	—	无
1.2.6	Security features defined for insecure services	—	无
1.2.7	Network security control rules reviewed every six months	—	无
1.2.8	Network security control configuration files secured	—	无
1.3.1	Inbound traffic to the CDE restricted	防火墙 / 网络分段	9 / 13
1.3.2	Outbound traffic from the CDE restricted	—	无
1.3.3	Network controls between wireless networks and the CDE	—	无
1.4.1	Network controls between trusted and untrusted networks	防火墙 / 网络分段	9 / 13
1.4.2	Inbound traffic from untrusted networks restricted	—	无
1.4.3	Anti-spoofing measures in place	—	无
1.4.4	Stored cardholder data not reachable from untrusted networks	—	无
1.4.5	Internal IP addresses and routing not disclosed	—	无
1.5.1	Controls on devices connecting to untrusted networks and the CDE	—	无
Requirement 2: Apply secure configurations to all system components · 11
2.1.1	Secure configuration policies documented and kept current	—	0
2.1.2	Roles for secure configuration assigned	—	0
2.2.1	System configuration standards developed and maintained	安全配置	9 / 13
2.2.2	Vendor default accounts managed or removed	安全配置	9 / 13
2.2.3	Functions with different security levels kept apart	—	无
2.2.4	Only necessary services and functions enabled	—	无
2.2.5	Insecure services justified and secured	—	无
2.2.6	System security parameters set to prevent misuse	—	无
2.2.7	Non-console administrative access encrypted	—	无
2.3.1	Wireless vendor defaults changed	—	0
2.3.2	Wireless keys changed when key holders leave	—	无
Requirement 3: Protect stored account data · 29
3.1.1	Stored account data policies documented and kept current	—	0
3.1.2	Roles for protecting stored account data assigned	—	0
3.2.1	Account data storage minimised, with retention and disposal	数据保护	11 / 13
3.3.1	Sensitive authentication data not kept after authorisation	数据保护	11 / 13
3.3.1.1	Full track data not kept after authorisation	—	无
3.3.1.2	Card verification code not kept after authorisation	—	无
3.3.1.3	PIN and PIN block not kept after authorisation	—	无
3.3.2	Sensitive authentication data encrypted before authorisation	—	无
3.3.3	Issuer storage of sensitive authentication data limited and protected	—	无
3.4.1	PAN masked when displayed	数据保护	11 / 13
3.4.2	PAN copying prevented over remote-access technologies	DLP	7 / 13
3.5.1	PAN rendered unreadable wherever stored	加密	10 / 13
3.5.1.1	Hashes of PAN are keyed cryptographic hashes	—	无
3.5.1.2	Disk-level encryption used only where it suffices	—	无
3.5.1.3	Disk encryption access managed separately from OS access	—	0
3.6.1	Procedures protect keys that secure stored account data	加密	10 / 13
3.6.1.1	Service providers document their cryptographic architecture	—	0
3.6.1.2	Secret and private keys stored in approved forms	—	0
3.6.1.3	Cleartext key components accessible to fewest custodians	—	0
3.6.1.4	Keys stored in the fewest possible locations	—	0
3.7.1	Key management: strong key generation	加密	10 / 13
3.7.2	Key management: secure key distribution	—	无
3.7.3	Key management: secure key storage	—	无
3.7.4	Key management: key changes at end of cryptoperiod	加密	10 / 13
3.7.5	Key management: retiring weakened or compromised keys	—	无
3.7.6	Key management: split knowledge and dual control	—	无
3.7.7	Key management: preventing unauthorised key substitution	—	无
3.7.8	Key custodians formally acknowledge their responsibilities	—	无
3.7.9	Service providers give customers key-handling guidance	—	无
Requirement 4: Protect cardholder data with strong cryptography during transmission · 6
4.1.1	Data-in-transit policies documented and kept current	—	0
4.1.2	Roles for protecting data in transit assigned	—	0
4.2.1	Strong cryptography for PAN over open, public networks	加密	10 / 13
4.2.1.1	Inventory of trusted keys and certificates kept	加密	10 / 13
4.2.1.2	Strong cryptography on wireless networks carrying PAN	—	无
4.2.2	PAN secured when sent by end-user messaging	—	无
Requirement 5: Protect all systems and networks from malicious software · 13
5.1.1	Anti-malware policies documented and kept current	—	0
5.1.2	Roles for malware protection assigned	—	0
5.2.1	Anti-malware deployed on system components	终端防护	10 / 13
5.2.2	Anti-malware detects, removes or contains known malware	终端防护	10 / 13
5.2.3	Systems without anti-malware periodically re-evaluated	—	0
5.2.3.1	Re-evaluation frequency set by targeted risk analysis	—	0
5.3.1	Anti-malware kept up to date	—	无
5.3.2	Periodic scans or continuous behavioural analysis	终端防护	10 / 13
5.3.2.1	Scan frequency set by targeted risk analysis	—	0
5.3.3	Removable media scanned or analysed	—	无
5.3.4	Anti-malware audit logs enabled and retained	—	无
5.3.5	Users cannot disable or alter anti-malware	—	无
5.4.1	Mechanisms to detect and protect against phishing	邮件安全	8 / 13
Requirement 6: Develop and maintain secure systems and software · 19
6.1.1	Secure systems and software policies documented	—	0
6.1.2	Roles for secure systems and software assigned	—	0
6.2.1	Bespoke and custom software developed securely	安全开发	8 / 13
6.2.2	Developers trained in secure software development	安全开发	8 / 13
6.2.3	Custom code reviewed before release	安全开发, API 安全	8 / 13
6.2.3.1	Manual code reviews approved by someone else	—	0
6.2.4	Coding techniques prevent common software attacks	API 安全	4 / 13
6.3.1	Vulnerabilities identified and risk-ranked	漏洞管理, 威胁情报, 补丁管理	13 / 13
6.3.2	Inventory of custom software and its components	供应链风险, 资产管理	13 / 13
6.3.3	Security patches installed promptly	补丁管理	10 / 13
6.4.1	Public web applications protected against attacks	Web 安全	6 / 13
6.4.2	Automated solution blocks attacks on public web apps	WAF	5 / 13
6.4.3	Payment page scripts authorised and integrity-checked	Web 安全	6 / 13
6.5.1	Production changes follow change control procedures	—	无
6.5.2	PCI DSS requirements re-confirmed after significant changes	—	无
6.5.3	Pre-production environments separated from production	—	无
6.5.4	Duties separated between production and pre-production	—	无
6.5.5	Live PANs not used in pre-production	—	无
6.5.6	Test data and accounts removed before go-live	—	无
Requirement 7: Restrict access to system components and cardholder data by business need to know · 12
7.1.1	Access restriction policies documented and kept current	—	0
7.1.2	Roles for access restriction assigned	—	0
7.2.1	Access control model defined	访问控制, 零信任	11 / 13
7.2.2	Access assigned by job function and least privilege	访问控制, 特权访问	12 / 13
7.2.3	Privileges approved by authorised personnel	—	无
7.2.4	User accounts and privileges reviewed every six months	访问控制	11 / 13
7.2.5	System and application accounts least privilege	—	无
7.2.5.1	System and application account access periodically reviewed	—	0
7.2.6	Access to cardholder data repositories restricted	—	无
7.3.1	Access control system restricts access by need	—	无
7.3.2	Access control system enforces assigned permissions	—	无
7.3.3	Access control system set to deny by default	—	无
Requirement 8: Identify users and authenticate access to system components · 29
8.1.1	Identification and authentication policies documented	—	0
8.1.2	Roles for identification and authentication assigned	—	0
8.2.1	Every user has a unique ID	访问控制	11 / 13
8.2.2	Shared or generic accounts only by documented exception	—	0
8.2.3	Service providers use unique credentials per customer	—	无
8.2.4	User ID changes authorised and controlled	—	无
8.2.5	Access revoked immediately on termination	—	0
8.2.6	Inactive user accounts disabled within 90 days	—	0
8.2.7	Third-party remote access accounts enabled only when needed	—	无
8.2.8	Re-authentication after 15 minutes idle	—	0
8.3.1	User and admin access requires an authentication factor	零信任	7 / 13
8.3.2	Authentication factors unreadable in transit and storage	—	无
8.3.3	Identity verified before changing authentication factors	—	无
8.3.4	Account lockout after repeated failed attempts	—	无
8.3.5	First-use and reset passwords unique and changed	—	0
8.3.6	Minimum password length and complexity	—	0
8.3.7	Recent passwords cannot be reused	—	0
8.3.8	Authentication guidance communicated to users	—	0
8.3.9	Password-only access: change every 90 days or analyse risk	—	0
8.3.10	Service providers give customers password guidance	—	0
8.3.10.1	Service provider customer passwords: rotation or analysis	—	0
8.3.11	Tokens, smart cards and certificates assigned to individuals	—	无
8.4.1	MFA for non-console administrative access to the CDE	多因素认证	10 / 13
8.4.2	MFA for all access into the CDE	多因素认证	10 / 13
8.4.3	MFA for remote network access	多因素认证	10 / 13
8.5.1	MFA systems configured to resist misuse	多因素认证	10 / 13
8.6.1	Interactive use of system accounts managed	—	无
8.6.2	No hard-coded passwords for system accounts	—	0
8.6.3	System account passwords protected and changed	—	0
Requirement 9: Restrict physical access to cardholder data · 27
9.1.1	Physical security policies documented and kept current	—	0
9.1.2	Roles for physical security assigned	—	0
9.2.1	Facility entry controls restrict CDE access	物理安全	8 / 13
9.2.1.1	Access to sensitive areas monitored by camera or access control	物理安全	8 / 13
9.2.2	Publicly accessible network jacks restricted	—	无
9.2.3	Physical access to network hardware restricted	物理安全	8 / 13
9.2.4	Consoles in sensitive areas locked when unattended	—	0
9.3.1	Personnel physical access authorised and managed	物理安全	8 / 13
9.3.1.1	Sensitive-area access authorised and revoked promptly	物理安全	8 / 13
9.3.2	Visitor access authorised, escorted and identifiable	物理安全	8 / 13
9.3.3	Visitor badges returned or deactivated	—	无
9.3.4	Visitor log maintained and retained	—	无
9.4.1	Media with cardholder data physically secured	—	无
9.4.1.1	Offline backup media stored securely	备份与恢复	11 / 13
9.4.1.2	Security of offline backup location reviewed annually	—	0
9.4.2	Media classified by data sensitivity	数据分类	9 / 13
9.4.3	Media sent off site tracked and secured	—	无
9.4.4	Management approves media moved off site	—	无
9.4.5	Inventory logs of electronic media kept	—	无
9.4.5.1	Electronic media inventories at least annually	—	无
9.4.6	Hard-copy media destroyed when no longer needed	—	0
9.4.7	Electronic media destroyed or made unrecoverable	—	0
9.5.1	Card-reading (POI) devices protected from tampering	—	无
9.5.1.1	Inventory of POI devices kept	—	0
9.5.1.2	POI devices inspected for tampering	—	0
9.5.1.2.1	Inspection frequency set by targeted risk analysis	—	0
9.5.1.3	Staff trained to spot POI tampering	—	无
Requirement 10: Log and monitor all access to system components and cardholder data · 27
10.1.1	Logging and monitoring policies documented	—	0
10.1.2	Roles for logging and monitoring assigned	—	0
10.2.1	Audit logs enabled and active	日志与审计, 内部威胁	11 / 13
10.2.1.1	Logs capture user access to cardholder data	—	无
10.2.1.2	Logs capture administrative actions	—	无
10.2.1.3	Logs capture access to audit logs	—	无
10.2.1.4	Logs capture invalid access attempts	—	无
10.2.1.5	Logs capture credential and privilege changes	—	无
10.2.1.6	Logs capture starting, stopping or pausing logging	—	无
10.2.1.7	Logs capture system-level object changes	—	无
10.2.2	Log entries record who, what, when, where and outcome	—	0
10.3.1	Read access to logs limited to need	—	0
10.3.2	Logs protected from modification	日志与审计, 取证分析	10 / 13
10.3.3	Logs promptly backed up to a central server	—	0
10.3.4	File-integrity monitoring on logs	—	0
10.4.1	Security event and critical logs reviewed daily	持续监控, SIEM / SOC	10 / 13
10.4.1.1	Automated mechanisms for log review	异常检测	9 / 13
10.4.2	Other logs reviewed periodically	—	无
10.4.2.1	Review frequency set by targeted risk analysis	—	0
10.4.3	Exceptions and anomalies addressed	—	无
10.5.1	Audit logs retained 12 months, three immediately available	日志与审计	10 / 13
10.6.1	System clocks synchronised	日志与审计	10 / 13
10.6.2	Time configuration correct and consistent	—	无
10.6.3	Time settings protected from change	—	0
10.7.1	Service providers detect security control failures	—	0
10.7.2	Critical security control failures detected and reported	—	0
10.7.3	Security control failures responded to promptly	—	无
Requirement 11: Test security of systems and networks regularly · 21
11.1.1	Security testing policies documented and kept current	—	0
11.1.2	Roles for security testing assigned	—	0
11.2.1	Wireless access points detected and unauthorised ones handled	—	0
11.2.2	Inventory of authorised wireless access points	—	无
11.3.1	Internal vulnerability scans every three months	漏洞管理	13 / 13
11.3.1.1	Lower-ranked vulnerabilities handled by risk analysis	—	0
11.3.1.2	Internal scans use authenticated scanning	—	无
11.3.1.3	Internal scans after significant changes	—	无
11.3.2	External ASV scans every three months	漏洞管理	13 / 13
11.3.2.1	External scans after significant changes	—	无
11.4.1	Penetration testing methodology defined	—	无
11.4.2	Internal penetration test at least annually	—	无
11.4.3	External penetration test at least annually	—	无
11.4.4	Penetration test findings corrected and retested	—	0
11.4.5	Segmentation controls tested at least annually	—	无
11.4.6	Service providers test segmentation every six months	—	无
11.4.7	Multi-tenant providers support customer penetration tests	—	无
11.5.1	Intrusion detection or prevention on network traffic	入侵检测	9 / 13
11.5.1.1	Service providers detect covert malware communication	—	无
11.5.2	Change-detection on critical files	—	无
11.6.1	Payment page changes and tampering detected	—	0
Requirement 12: Support information security with organizational policies and programs · 37
12.1.1	Information security policy established and published	治理政策	9 / 13
12.1.2	Security policy reviewed at least annually	治理政策	9 / 13
12.1.3	Security roles and responsibilities defined	角色与职责	9 / 13
12.1.4	Executive responsibility for information security assigned	角色与职责	9 / 13
12.2.1	Acceptable use policies for end-user technologies	—	无
12.3.1	Targeted risk analysis for flexible-frequency requirements	风险管理, 风险评估	10 / 13
12.3.2	Targeted risk analysis for customised approach	—	0
12.3.3	Cipher suites and protocols reviewed annually	—	0
12.3.4	Hardware and software technologies reviewed annually	—	0
12.4.1	Service providers: executive responsibility for PCI DSS compliance	—	无
12.4.2	Service providers: quarterly reviews of operational tasks	合规	10 / 13
12.4.2.1	Service providers: quarterly review results documented	—	0
12.5.1	Inventory of in-scope system components	资产管理	13 / 13
12.5.2	PCI DSS scope confirmed annually and on change	业务环境	5 / 13
12.5.2.1	Service providers confirm scope every six months	—	无
12.5.3	Service providers review scope after organisational change	—	0
12.6.1	Formal security awareness programme	意识与培训	10 / 13
12.6.2	Awareness programme reviewed annually	—	无
12.6.3	Awareness training on hire and at least annually	意识与培训	10 / 13
12.6.3.1	Training covers phishing and social engineering	—	无
12.6.3.2	Training covers acceptable use of technology	—	无
12.7.1	Personnel screened before hire	内部威胁	8 / 13
12.8.1	List of third-party service providers kept	供应链风险, 云安全, 供应商风险管理	12 / 13
12.8.2	Written agreements with service providers	供应商风险管理	10 / 13
12.8.3	Due diligence before engaging service providers	供应商风险管理	10 / 13
12.8.4	Service provider compliance monitored annually	供应商风险管理	10 / 13
12.8.5	Responsibilities split with each provider documented	云安全, 供应商风险管理	12 / 13
12.9.1	Service providers acknowledge responsibilities to customers	—	0
12.9.2	Service providers support customer compliance requests	—	0
12.10.1	Incident response plan ready to activate	事件响应, 缓解, 报告, 恢复规划, 业务连续性, 灾难恢复	12 / 13
12.10.2	Incident response plan reviewed and tested annually	事件响应	12 / 13
12.10.3	Incident response staff available around the clock	事件响应	12 / 13
12.10.4	Incident response staff trained	事件响应	12 / 13
12.10.4.1	Training frequency set by targeted risk analysis	—	0
12.10.5	Plan covers alerts from security monitoring	—	0
12.10.6	Plan updated from lessons learned and industry changes	经验教训	9 / 13
12.10.7	Procedures for PAN found where it shouldn't be	—	0
Appendix A: additional requirements · 10
A1.1.1	Multi-tenant providers: separate provider and customer environments	—	无
A1.1.2	Multi-tenant providers: customers confined to their own environment	—	无
A1.1.3	Multi-tenant providers: customers reach only their own data	—	无
A1.1.4	Multi-tenant providers: separation tested every six months	—	无
A1.2.1	Multi-tenant providers: audit logging for each customer	—	无
A1.2.2	Multi-tenant providers: support customer forensic investigations	—	无
A1.2.3	Multi-tenant providers: report suspected incidents to customers	—	无
A2.1.1	POI terminals using SSL or early TLS not exploitable	—	无
A2.1.2	Service providers: migration plan off SSL and early TLS	—	无
A2.1.3	Service providers offer a secure connection option	—	无

主题覆盖情况

已映射 PCI DSS 要求的主题（46）：

本站数据中无映射 无 PCI DSS 要求（4）：