Tag
PCI DSS
27 articles
Compliance frameworks
PCI DSS requirement 10: logging and log review
What PCI DSS Requirement 10 says to log, the fields every entry needs, which logs need daily review, how long to keep them, and what assessors ask to see.
6 min read
Security engineering
Key management and rotation
How key hierarchies, separation of duties, rotation and key deletion work in a cloud KMS, what PCI DSS and ISO 27001 expect, and the evidence auditors test.
6 min read
Security engineering
Encryption at rest and in transit
What encryption at rest and in transit each protect against, the layers where each applies, what the frameworks say, and the evidence an auditor accepts.
6 min read
Compliance frameworks
PCI DSS requirement 8 and multi-factor authentication
PCI DSS 4.0 requires MFA for all access into the cardholder data environment. Which access paths need it, the exemptions, and how the MFA system must work.
6 min read
Security engineering
Secrets management for engineering teams
Where application secrets should live, how to retire long-lived credentials, what to do in the first hour after a leak, and the evidence auditors ask for.
6 min read
Security engineering
Branch protection rules auditors look for
The branch protection settings that make code review a testable control, the bypass paths auditors probe, and the evidence that proves it held all period.
7 min read
Compliance frameworks
The PCI DSS customized approach
The customized approach lets you meet a PCI DSS objective with your own control. What you must document, how assessors test it, and when it is worth it.
6 min read
Security engineering
Code review as a change management control
For most software teams, the pull request review is the change approval. What it must establish, which changes it must cover, and how auditors sample it.
6 min read
Audit readiness
How long to keep audit evidence
What SOC 2, ISO 27001, HIPAA and PCI DSS say about keeping evidence, what the audit cycle implies, and why privacy law limits how long you should keep it.
6 min read
Compliance frameworks
QSA vs ISA: who assesses PCI DSS
A QSA assesses any organization; an ISA assesses only its own employer. What each role can sign, who decides which you need, and how to choose a QSA firm.
6 min read
Risk and vendors
Continuous vendor monitoring
What to watch between annual vendor reviews: report expiry, incidents, sub-processor and usage changes, what each signal should trigger, and cadence by tier.
6 min read
Security engineering
Running a tabletop exercise
A tabletop exercise is how most teams test an incident response plan. How to set objectives, write injects, run the session, and produce a report that counts.
6 min read
Audit readiness
Running several audits on one calendar
How to fit SOC 2, ISO 27001 and PCI DSS into one year: each audit's fixed dates, aligning or staggering fieldwork, and annual controls that serve all three.
6 min read
Compliance frameworks
ASV scans: what passes and what fails
PCI DSS requires a passing external scan from an Approved Scanning Vendor every quarter. How scope is set, what fails a scan, and how to dispute a finding.
6 min read
Security engineering
Security monitoring and alerting
Logs prove nothing until someone looks. Which detections to build first, how to route and triage alerts, tune without losing coverage, and evidence it all.
6 min read
Security engineering
Centralized logging for compliance
What to log, what each event must contain, how long to keep it, and how to protect it. Centralized logging mapped to SOC 2, ISO 27001, PCI DSS and HIPAA.
5 min read
Compliance frameworks
Network segmentation for PCI DSS
Segmentation is not a PCI DSS requirement, but without it your whole network is in scope. What counts as isolation, how to test it, and where it usually fails.
6 min read
Compliance frameworks
Why the same control appears in four frameworks
SOC 2, ISO 27001, HIPAA and PCI DSS ask overlapping questions in different words. Mapping once and reusing the evidence is what makes the second one fast.
3 min read
Compliance frameworks
Tokenization and PCI DSS scope
Tokenization takes systems out of PCI DSS scope only under certain conditions. Where the vault sits, who can detokenize, and what assessors check in a design.
6 min read
Security engineering
Vulnerability management SLAs auditors accept
Auditors test whether you met your own remediation windows. How to set severity tiers and SLAs you can keep, handle exceptions, and evidence every finding.
6 min read
Compliance frameworks
Reducing your PCI DSS scope
Every in-scope system must meet every applicable PCI DSS requirement. How scope works, the options that shrink it, and the ones that only look like they do.
6 min read
Security engineering
Offboarding that removes access the same day
Late access removal is a classic audit exception. How to set a testable standard, start from a trigger you trust, and remove access in the right order.
6 min read
Security engineering
Managing privileged access
Admin accounts carry most of your access risk. How to find them, separate them, grant elevation for hours instead of years, and log what privileged users do.
6 min read
Compliance frameworks
Choosing the right PCI DSS self-assessment questionnaire
Which PCI DSS self-assessment questionnaire fits depends on how you take card payments, not your size. The SAQ types, their eligibility tests, and the traps.
6 min read