Openlane
PCI DSS logo

PCI DSS compliance

Scope the cardholder data environment, tie each of the 12 requirements to the controls you operate, and keep dated scan and review history where an assessor can find it.

No credit card. 30-day free trial.

The cardholder data environment, documented and current

Each requirement carries the controls behind it, and each control carries its owner, its evidence, and the date it was last reviewed, so the assessment starts from a current record.

Cardholder data protection

Write the controls behind Requirements 3 and 4, from retention limits to encryption in transit, with an owner and evidence on each.

  • Retention and disposal policies linked to controls
  • Encryption evidence per requirement

Network scope and segmentation

Record the systems in the cardholder data environment in your platform inventory, and attach configuration reviews and segmentation test results to the controls they demonstrate.

  • CDE systems in the registry
  • Segmentation test evidence

Vulnerability management

Run scans against your public domains on a schedule and ingest the scans your providers already run. Every run is dated and kept, which is the history Requirement 11.3 asks you to show. External quarterly scans still come from an Approved Scanning Vendor.

  • Dated scan history per run
  • Provider scans in the same view
  • Findings with remediation owners

Access controls

Attach evidence for unique IDs, least privilege, and multifactor authentication to Requirements 7 and 8, and run recurring access reviews.

  • Recurring access reviews
  • MFA evidence per requirement

Logging and testing

Keep log review records, penetration test reports, and change detection evidence tied to Requirements 10 and 11, with renewal dates so annual items surface before they lapse.

  • Penetration test reports as evidence
  • Renewal dates on annual items

Security policy management

Maintain the policies Requirement 12 calls for, track annual reviews, and run security awareness training as a recurring campaign.

  • Policy templates with version history
  • Training campaigns with completion tracking
Part of Compliance

Keep the CDE documented between assessments

Tie each requirement to its controls, scan history, and review evidence before the next assessment.

Request a Framework

No credit card. 30-day free trial.

Frequently asked questions

PCI DSS basics

What is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is the security standard for organizations that store, process, or transmit payment card data. It is maintained by the PCI Security Standards Council, founded by the major card brands, and the current version is v4.0.1.

Who needs to comply with PCI DSS?

Any organization that accepts, transmits, or stores cardholder data, regardless of size or transaction volume: merchants, service providers, payment processors, and any entity that handles payment card data on behalf of others.

What are the PCI DSS compliance levels?

The card brands classify merchants into four levels by annual transaction volume; Visa's definitions run from Level 1 (over six million transactions) to Level 4 (fewer than 20,000 e-commerce transactions). The level determines how you validate compliance: a Report on Compliance from a Qualified Security Assessor at Level 1, a Self-Assessment Questionnaire at the others.

What is cardholder data?

Cardholder data is the primary account number (PAN) together with the cardholder name, expiration date, and service code. Sensitive authentication data, such as full track data, card verification codes, and PINs, must never be stored after authorization. Storing, processing, or transmitting the PAN is what brings a system into scope.

Requirements and controls

What are the 12 PCI DSS requirements?

The 12 requirements fall under six goals. Build and maintain a secure network and systems (Requirements 1 and 2). Protect account data (3 and 4). Maintain a vulnerability management program (5 and 6). Implement strong access control measures (7, 8, and 9). Regularly monitor and test networks (10 and 11). Maintain an information security policy (12).

What is the Cardholder Data Environment (CDE)?

The CDE is the people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, plus any system connected to or able to affect it. Segmenting the CDE from the rest of the network reduces the number of systems in scope.

How often must vulnerability scans be performed?

Requirement 11.3.1 calls for internal vulnerability scans at least once every three months, and Requirement 11.3.2 calls for external scans at least once every three months performed by a PCI SSC Approved Scanning Vendor (ASV). Both must also run after significant changes, and high-risk and critical findings must be resolved and rescanned.

What are the encryption requirements?

Requirement 3 requires stored PAN to be rendered unreadable with strong cryptography or an equivalent method, and limits what may be stored at all. Requirement 4 requires strong cryptography for cardholder data sent over open, public networks. Keys must be managed and rotated under documented procedures.

Openlane for PCI DSS

How does Openlane help with PCI DSS compliance?

Openlane ties each PCI DSS requirement to the controls you operate in the cardholder data environment, with an owner and evidence behind each one. Scan history, access reviews, and test reports stay dated and attached, so your QSA or your SAQ starts from a current record.

Can Openlane help with quarterly compliance activities?

Recurring reviews, such as access reviews and firewall rule reviews, run as recurring tasks and campaigns with owners and due dates, and the results attach to the requirement they satisfy. Scans you run against your public domains and scans you ingest from providers are dated and kept, which is the history Requirement 11.3 asks you to show. External scans for 11.3.2 still come from an ASV.

Does Openlane support multiple PCI DSS validation methods?

Whether you complete a Self-Assessment Questionnaire or undergo a Report on Compliance assessment, the controls map to the same requirements and sub-requirements, and the evidence for each is organized where the assessor or the questionnaire asks for it.

© Copyright theopenlane, Inc. All Rights Reserved.

Openlane on Product Hunt
California Consumer Privacy Act (CCPA) Opt-Out IconYour Privacy ChoicesNotice at Collection