Build and maintain a secure network
Network security controls and secure configurations, evidenced against the asset register.
- Network controls
- Secure configuration
Industry standard
PCI DSS v4: Payment Card Industry Data Security Standard
Twelve requirements with an assessor at the end of them. What matters in a GRC platform is that the evidence behind each requirement is reviewed, dated and reusable, and that the cardholder-data scope is a set of assets rather than a diagram in a folder.
Published by the PCI Security Standards Council and applied wherever payment cards are accepted, processed or stored.
Treatment decision
- 1Treatment planActions with owners, priority, and due dates
- 2Action trackingStatus per action, SLA where defined
- 3ReassessmentResidual score recalculated after closure
12
Principal requirements
Scoped
By asset and environment
Reviewed
Evidence, not just uploaded
Graded
Mapping to other standards
Requirement groups
Where each group of requirements is evidenced
The standard groups its twelve requirements under six goals. Each is a set of controls in the library with evidence expectations attached.
Protect account data
Storage, retention and transmission of cardholder data, with the data-classification tag on every asset in scope.
- Storage
- Retention
- Encryption in transit
Maintain a vulnerability management programme
Malware protection and secure development, fed by the vulnerability catalogue and its SLAs.
- Malware
- Secure development
- Patch SLA
Implement strong access control
Need-to-know access, identification and physical access, evidenced by permission bundles and reviews.
- Need to know
- Authentication
- Physical access
Regularly monitor and test networks
Logging and testing on a schedule, recorded as control test runs with results.
- Logging
- Testing
- Scheduled control tests
Maintain an information security policy
The policy set, versioned and acknowledged, mapped at clause level to the requirements it implements.
- Policy
- Acknowledgement
- Third-party programme
Platform mapping
Assessment-ready without the pre-assessment scramble
Scope is a set of assets
Cardholder-data environment membership is a classification on the asset, so the in-scope list is a query and the assessor's first question has an answer.
Evidence with a review step
Every artefact is reviewed and accepted before the requirement reads as met, and reused across the ISO/IEC 27001 controls it also satisfies.
Control tests on a schedule
Quarterly and annual testing obligations become scheduled control test runs with recorded results, escalated when overdue.
Service providers in the vendor register
Third parties that touch cardholder data are tiered, contracted and monitored in the same third-party module, with obligations tracked.
Compensating controls on the record
Where a requirement is met another way, the exception names the requirement, the compensating controls and the approver, and expires unless renewed.
Gaps become findings
A requirement not in place raises a finding with severity, owner and a remediation plan whose activities can depend on one another.
Maturity
How maturity is scored
Every requirement is scored on the platform's six-level scale, each level carrying a written descriptor so a score means the same thing in two different business units.
Level 0
Not Performed
The practice does not happen. Recorded as an explicit level rather than a blank.
Level 1
Performed Informally
It happens, but it depends on individuals and is neither planned nor tracked.
Level 2
Planned & Tracked
Planned, resourced, and monitored, though practice still varies between teams.
Level 3
Well Defined
A defined standard process, applied consistently across the organisation.
Level 4
Quantitatively Controlled
Measured against targets, with deviation detected from the measurements themselves.
Level 5
Continuously Improving
Improvement is fed by the measurements, changing the process rather than the reporting.
Related products
Walk into the assessment with scope and evidence already on record
Book a walkthrough with our GRC specialists and see the platform run against the frameworks you are held to.
No commitment required. A typical demo runs 45 minutes.