PCI DSS

PCI DSS is the Payment Card Industry Data Security Standard, maintained by the PCI Security Standards Council for entities that store, process or transmit cardholder data. Pentr's YAML declares it as name PCI DSS v4.0, version 4.0, and its controls are requirements, with ids prefixed Req-.

Controls¶

The requirements the YAML declares, and the tables that reach each one. The Reached by column is explained on Frameworks.

Control	Name	Reached by
Req-2.2	Secure configurations applied	WSTG, keywords
Req-3.5	PAN data protection	ATT&CK, keywords
Req-4.2	Strong cryptography in transit	WSTG, keywords
Req-6.2	Bespoke and custom software developed securely	ATT&CK, WSTG, keywords
Req-6.3	Vulnerabilities identified and addressed	keywords
Req-6.4	Public-facing web applications protected	ATT&CK, WSTG, keywords
Req-7.2	Access to system components is controlled	ATT&CK, WSTG, keywords
Req-8.3	Strong authentication	ATT&CK, WSTG, keywords
Req-11.3	External and internal vulnerabilities identified and addressed	ATT&CK, keywords
Req-11.4	Penetration testing	none

Req-11.4 reads none: no table lists it, so it is reported not_tested on every run.

Req-6.3 is reached through the keyword table alone. It is tested only by a finding whose ATT&CK and WSTG ids matched no row, and it never appears among the control ids in a sealed manifest.

ATT&CK technique mappings¶

Each ATT&CK technique id in the framework's table and the requirements it maps to. A finding tagged with one of these ids maps to every requirement in its row.

Technique	Controls
T1190	Req-6.2, Req-6.4, Req-11.3
T1078	Req-8.3, Req-7.2
T1059	Req-6.2
T1068	Req-7.2
T1110	Req-8.3
T1003	Req-3.5, Req-8.3
T1046	Req-11.3
T1018	Req-11.3
T1021	Req-7.2
T1083	Req-7.2

WSTG mappings¶

Each WSTG id in the framework's table and the requirements it maps to. A finding tagged with one of these ids maps to every requirement in its row.

WSTG id	Controls
WSTG-INPV-05	Req-6.2, Req-6.4
WSTG-INPV-01	Req-6.2, Req-6.4
WSTG-INPV-02	Req-6.2, Req-6.4
WSTG-ATHN-04	Req-8.3
WSTG-ATHN-01	Req-4.2
WSTG-IDNT-04	Req-8.3
WSTG-CRYP-01	Req-4.2
WSTG-CONF-01	Req-2.2
WSTG-CONF-02	Req-2.2
WSTG-ATHZ-01	Req-7.2
WSTG-SESS-02	Req-8.3
WSTG-ERRH-01	Req-6.2

What Pentr does not attest to¶

• tested means at least one finding mapped to the requirement. It does not mean the requirement was assessed, met or failed. A mapping made by the keyword step can attach a requirement the finding does not bear on; see Frameworks.
• not_tested means no finding mapped to the requirement. It does not mean the requirement passed, and it says nothing about whether the requirement is in place.
• The mapping tables are Pentr's, written for the application. They are not published by the PCI Security Standards Council.
• A requirement that the YAML does not declare has no row in the report.
• Req-11.4 is the requirement for penetration testing itself. The mapping makes no statement about whether a Pentr run meets it.
• A Pentr report is not a Report on Compliance or an Attestation of Compliance, and not an audit opinion.

The product page for this framework is PCI DSS.