PCI DSS Gap Analyzer

Firewall rules are documented and reviewed every six months.

Default passwords on network security devices have been changed.

Cardholder data environment (CDE) is segmented from the rest of the corporate network.

Default system passwords and security parameters have been changed before deployment.

Only necessary services, protocols, and functions are enabled on systems in the CDE.

Primary account numbers (PANs) are rendered unreadable (encrypted or tokenized) wherever stored.

Encryption keys are stored securely and managed with a formal key-management program.

PAN display is masked (showing only the last 4 digits) except when required by business need.

Strong cryptography (TLS 1.2 or higher) is used to protect CHD in transit across open/public networks.

All transmission of CHD over internal networks is encrypted.

Anti-malware software is deployed on all systems commonly affected by malware (desktops, laptops, servers).

Anti-malware mechanisms are actively running, cannot be disabled by users, and generate audit logs.

Security patches are applied within 30 days of release (critical patches within 15 days).

A formal software development lifecycle (SDLC) includes security reviews for in-scope applications.

Public-facing web applications are protected by an automated technical solution (WAF or code review).

Access to CHD is restricted on a need-to-know basis with documented business justification.

System access is assigned based on job role and minimum necessary privilege.

Strong password policies enforce minimum length (12+ chars), complexity, expiration, and history.

Multi-factor authentication (MFA) is required for all remote and administrative access to the CDE.

Unique user IDs exist for each person with access to CHD, shared or generic accounts are not used.

Physical access to areas where CHD is processed, stored, or transmitted is restricted and monitored.

All media containing CHD is physically secured and access is logged.

Media destruction of CHD follows approved procedures and is documented.

Audit trails capture all individual user access to CHD and all administrative actions.

System clocks and time settings are synchronized across all in-scope systems.

Logs are protected from tampering and retained for at least 12 months (3 months immediately available).

Network vulnerability scans are performed quarterly by an Approved Scanning Vendor (ASV).

Penetration testing is performed annually and after significant infrastructure changes.

Intrusion detection/prevention systems (IDS/IPS) monitor all traffic in and out of the CDE.

File integrity monitoring (FIM) detects unauthorized changes to critical system files.

A formal information security policy exists, is approved by management, and is reviewed annually.

A risk assessment is performed annually and after significant changes.

An incident response plan exists, is tested annually, and includes notification procedures.

A formal change management process is followed for all changes to the CDE.

Third-party service providers with CHD access are assessed and monitored.

Employees acknowledge the security policy upon hire and annually thereafter.

Security awareness training is delivered to all personnel with CHD access.

Screening of new hires includes background checks for personnel with CHD access.