PCI DSS Compliance Planning

Comprehensive guidance for Payment Card Industry Data Security Standard compliance before development begins.

When to Use This Skill

• Building e-commerce or payment processing systems

• Integrating with payment gateways or processors

• Designing scope reduction strategies (tokenization, P2PE)

• Selecting appropriate SAQ for your business

• Preparing for PCI DSS assessments

PCI DSS Fundamentals

Cardholder Data Elements

Data Element Description Storage Permitted? Protection Required

PAN Primary Account Number (16 digits) Yes, if protected Render unreadable

Cardholder Name Name on card Yes Protect per requirement

Service Code 3-4 digit code Yes Protect per requirement

Expiration Date MM/YY Yes Protect per requirement

CVV/CVC Card verification value NEVER after auth N/A - never store

PIN/PIN Block Personal identification NEVER after auth N/A - never store

Full Track Data Magnetic stripe data NEVER after auth N/A - never store

The 12 Requirements (PCI DSS 4.0)

Goal 1: Build and Maintain a Secure Network and Systems

1. Install and maintain network security controls
2. Apply secure configurations to all system components

Goal 2: Protect Account Data 3. Protect stored account data 4. Protect cardholder data with strong cryptography during transmission

Goal 3: Maintain a Vulnerability Management Program 5. Protect all systems and networks from malicious software 6. Develop and maintain secure systems and software

Goal 4: Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know 8. Identify users and authenticate access to system components 9. Restrict physical access to cardholder data

Goal 5: Regularly Monitor and Test Networks 10. Log and monitor all access to system components and cardholder data 11. Test security of systems and networks regularly

Goal 6: Maintain an Information Security Policy 12. Support information security with organizational policies and programs

Scope Reduction Strategies

Understanding PCI Scope

In Scope: Any system that stores, processes, or transmits cardholder data, OR connects to systems that do.

Scope Reduction Goal: Minimize systems handling raw cardholder data.

Strategy 1: Tokenization

Replace PAN with non-sensitive token; processor stores actual card data.

// Client-side tokenization flow public class PaymentTokenization { private readonly IPaymentGateway _gateway;

public async Task<PaymentResult> ProcessPayment(
    string clientToken, // Token created in browser via gateway's JS
    decimal amount,
    string currency,
    CancellationToken ct)
{
    // Server never sees raw card data - only token
    var request = new ChargeRequest
    {
        Token = clientToken,
        Amount = amount,
        Currency = currency,
        MerchantReference = Guid.NewGuid().ToString()
    };

    // Token is exchanged for payment at gateway
    var result = await _gateway.Charge(request, ct);

    // Store only the transaction reference, never card data
    return new PaymentResult
    {
        TransactionId = result.TransactionId,
        Status = result.Status,
        // Store token for recurring payments (if vaulted)
        VaultToken = result.VaultToken
    };
}

}

// Scope: Only gateway SDK is in scope, not your entire application

Strategy 2: Hosted Payment Page (Redirect)

Customer enters card data on processor's page; you never handle card data.

public class HostedPaymentFlow { private readonly IHostedPaymentProvider _provider;

public async Task<string> CreatePaymentSession(
    Order order,
    CancellationToken ct)
{
    var session = await _provider.CreateSession(new SessionRequest
    {
        Amount = order.Total,
        Currency = order.Currency,
        SuccessUrl = $"https://example.com/payment/success?order={order.Id}",
        CancelUrl = $"https://example.com/payment/cancel?order={order.Id}",
        WebhookUrl = "https://example.com/api/payment-webhook",
        Metadata = new Dictionary<string, string>
        {
            ["order_id"] = order.Id.ToString()
        }
    }, ct);

    // Redirect customer to processor's hosted page
    return session.RedirectUrl;
}

// Webhook receives payment confirmation - no card data
public async Task HandleWebhook(PaymentWebhook webhook, CancellationToken ct)
{
    // Verify webhook signature
    if (!_provider.VerifySignature(webhook))
        throw new SecurityException("Invalid webhook signature");

    // Update order status
    var orderId = Guid.Parse(webhook.Metadata["order_id"]);
    await _orderService.MarkPaid(orderId, webhook.TransactionId, ct);
}

}

Strategy 3: iFrame/Embedded Fields

Card fields are hosted by processor but appear on your page.

<!-- Stripe Elements example - fields hosted by Stripe --> <form id="payment-form"> <div id="card-element"> <!-- Stripe injects secure card input here --> </div> <button type="submit">Pay</button> </form>

<script> // Card data never touches your server const stripe = Stripe('pk_live_xxx'); const elements = stripe.elements(); const cardElement = elements.create('card'); cardElement.mount('#card-element');

form.addEventListener('submit', async (e) => { e.preventDefault(); // Token created client-side, sent to your server const {token} = await stripe.createToken(cardElement); // Only token goes to your server await fetch('/api/payment', { method: 'POST', body: JSON.stringify({ token: token.id }) }); }); </script>

Strategy 4: Point-to-Point Encryption (P2PE)

Hardware encrypts card data at swipe; decryption only at processor.

Card Swipe → P2PE Terminal → Encrypted → Your Systems → Processor (can't decrypt)

Benefits:

• Your systems handle encrypted data only
• Dramatically reduced scope
• Requires P2PE validated solution

Scope Reduction Comparison

Strategy Your PCI Scope SAQ Type Complexity

Store raw cards Full environment D Very High

Tokenization (API) Token handling systems A-EP or D Medium

iFrame/Hosted Fields Minimal (web page) A or A-EP Low

Redirect to Processor None (referrer only) A Very Low

P2PE Hardware Terminal + network P2PE Low

SAQ Selection Guide

SAQ Types Overview

SAQ Applies To Requirements Questions

A E-commerce, all card functions outsourced No CHD on your systems ~24

A-EP E-commerce, website impacts card security iFrame/JS approach ~191

B Imprint/standalone dial terminals only No electronic storage ~41

B-IP Standalone IP-connected terminals No electronic storage ~82

C Payment app on internet-connected systems No electronic storage ~160

C-VT Virtual terminal, no electronic storage Web-based, no storage ~79

D All other merchants Full requirements ~329

D (SP) Service providers Full requirements ~400+

P2PE Using validated P2PE solution Terminal + P2PE ~33

Decision Tree

Do you store/process/transmit CHD electronically? ├─ NO: Are you e-commerce only? │ ├─ YES: All card functions outsourced? │ │ ├─ YES → SAQ A │ │ └─ NO: Website controls redirect/iFrame? │ │ ├─ YES → SAQ A-EP │ │ └─ NO → SAQ D │ └─ NO: Card-present only? │ ├─ Imprint/standalone dial → SAQ B │ ├─ Standalone IP terminals → SAQ B-IP │ ├─ P2PE validated solution → SAQ P2PE │ └─ Other → SAQ C or D └─ YES: → SAQ D (full assessment)

Security Controls Implementation

Requirement 3: Protect Stored Account Data

// PAN masking (display only first 6, last 4) public static class PanMasking { public static string Mask(string pan) { if (string.IsNullOrEmpty(pan) || pan.Length < 13) return pan;

    // First 6 (BIN) + masked middle + last 4
    var first6 = pan[..6];
    var last4 = pan[^4..];
    var maskedLength = pan.Length - 10;

    return $"{first6}{new string('*', maskedLength)}{last4}";
}

// Example: 4111111111111111 → 411111******1111

}

// Strong cryptography for stored PAN (when storage required) public class PanEncryption { private readonly IKeyManagement _keyManager;

public async Task<EncryptedPan> Encrypt(string pan, CancellationToken ct)
{
    // Use AES-256 minimum
    var key = await _keyManager.GetCurrentKey("pan-encryption", ct);

    using var aes = Aes.Create();
    aes.Key = key.KeyMaterial;
    aes.GenerateIV();

    using var encryptor = aes.CreateEncryptor();
    var plainBytes = Encoding.UTF8.GetBytes(pan);
    var encryptedBytes = encryptor.TransformFinalBlock(plainBytes, 0, plainBytes.Length);

    return new EncryptedPan
    {
        EncryptedData = Convert.ToBase64String(encryptedBytes),
        KeyId = key.KeyId,
        IV = Convert.ToBase64String(aes.IV)
    };
}

}

Requirement 4: Encrypt Transmission

// TLS 1.2+ enforcement public static class TlsConfiguration { public static void ConfigureSecureDefaults() { // Disable older protocols ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls13; } }

// ASP.NET Core configuration public class Program { public static void Main(string[] args) { var builder = WebApplication.CreateBuilder(args);

    builder.WebHost.ConfigureKestrel(options =>
    {
        options.ConfigureHttpsDefaults(https =>
        {
            https.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13;
        });
    });

    // ... rest of configuration
}

}

Requirement 8: Authentication

// Multi-factor authentication for CDE access public class PciMfaPolicy { public bool RequiresMfa(string userId, string resourcePath) { // MFA required for all CDE access var cdeResources = new[] { "/admin/payments", "/api/transactions", "/reports/cardholder" };

    return cdeResources.Any(r =>
        resourcePath.StartsWith(r, StringComparison.OrdinalIgnoreCase));
}

}

// Password policy (PCI DSS 4.0) public class PciPasswordPolicy : IPasswordPolicy { public PasswordRequirements GetRequirements() { return new PasswordRequirements { MinimumLength = 12, // 4.0 increased from 7 RequireComplexity = true, // Multiple character types MaxAgeInDays = 90, // Force change every 90 days HistoryCount = 4, // Can't reuse last 4 LockoutThreshold = 10, // Lock after 10 failed attempts LockoutDurationMinutes = 30, IdleTimeoutMinutes = 15 // Session timeout for CDE access }; } }

Requirement 10: Logging and Monitoring

// PCI-compliant audit logging public class PciAuditLogger { private readonly ILogger _logger; private readonly TimeProvider _timeProvider;

public void LogCdeAccess(CdeAccessEvent accessEvent)
{
    // PCI requires: who, what, when, where, success/failure
    var entry = new AuditEntry
    {
        Timestamp = _timeProvider.GetUtcNow(),
        UserId = accessEvent.UserId,
        UserName = accessEvent.UserName,
        EventType = accessEvent.EventType.ToString(),
        Resource = accessEvent.Resource,
        Action = accessEvent.Action,
        SourceIp = accessEvent.SourceIp,
        Success = accessEvent.Success,
        Details = accessEvent.Details
    };

    // Never log actual card data
    _logger.LogInformation(
        "CDE_ACCESS: User={UserId} Action={Action} Resource={Resource} Success={Success} IP={SourceIp}",
        entry.UserId,
        entry.Action,
        entry.Resource,
        entry.Success,
        entry.SourceIp);

    // Retain logs for minimum 1 year
    // Immediately available for 3 months
}

public void LogSecurityEvent(SecurityEvent secEvent)
{
    // Security events to log:
    // - All access to CHD
    // - All actions by admin/root
    // - All invalid access attempts
    // - Creation/deletion of system objects
    // - Initialization of audit logs
    // - Stopping/pausing of audit logs
}

}

Network Segmentation

CDE Network Isolation

┌─────────────────────────────────────────────────────────────┐ │ Corporate Network │ │ ┌──────────────────────────────────────────────────────┐ │ │ │ Cardholder Data Environment │ │ │ │ ┌──────────┐ ┌──────────┐ ┌──────────┐ │ │ │ │ │ Payment │ │ Database │ │ Admin │ │ │ │ │ │ Server │────│ Server │────│ Jumphost │ │ │ │ │ └──────────┘ └──────────┘ └──────────┘ │ │ │ │ │ │ │ │ │ │ │ ← Firewall/ACLs → │ │ │ │ └───────┼──────────────────────────────┼──────────────┘ │ │ │ │ │ │ ┌─────▼─────┐ ┌─────▼─────┐ │ │ │ Web App │ │ Admin │ │ │ │ (no CHD) │ │ Worksta. │ │ │ └───────────┘ └───────────┘ │ └─────────────────────────────────────────────────────────────┘

Firewall Rules for CDE

Example firewall rules

CDE_Ingress:

• Allow: Payment API (443) from Web Tier only
• Allow: SSH (22) from Jumphost only
• Allow: Database (5432) from Payment Server only
• Deny: All other

CDE_Egress:

• Allow: Payment Processor API (443)
• Allow: NTP (123) to approved servers
• Allow: Syslog (514) to SIEM
• Deny: All other

PCI Compliance Checklist

Before Development

• Identify all payment flows

• Select scope reduction strategy

• Choose appropriate SAQ type

• Establish CDE boundaries

• Review vendor PCI compliance (AOCs)

Architecture & Design

• Document network segmentation

• Define encryption strategy (storage and transit)

• Design access control model

• Plan audit logging approach

• Ensure no CVV/PIN storage

Development

• Never log card data

• Implement TLS 1.2+ only

• Apply PAN masking for display

• Enforce MFA for CDE access

• Follow secure coding (Req 6)

Testing & Assessment

• Vulnerability scanning (internal/external quarterly)

• Penetration testing (annual)

• Segmentation testing (if segmented)

• Application security testing

Cross-References

• Security Frameworks: security-frameworks for control mapping

• Data Classification: data-classification for CHD handling

• License Compliance: license-compliance for payment SDK terms

Resources

• PCI SSC Document Library

• PCI DSS 4.0 Quick Reference Guide

• SAQ Instructions and Guidelines