Control adoption self-assessment

Track how many of the recommended AWS controls you have adopted across the 12 PCI DSS requirements. This measures control adoption and maturity, not PCI DSS compliance or certification.

ⓘ Your assessment stays in this browser only. Nothing is sent to a server. Export it to a file to back it up or move it between devices. Record evidence as references (ARNs, Config rule names), not secrets.

Coverage ⓘ

0 of 54 adopted

Implemented: 0

Adoption by maturity phase

Quick Wins

Foundational

Efficient

Optimized

Import

✓ Saved

Scope

These are optional labels only. They are not validated and are just saved with your assessment and included when you export it.

Organization Environment AWS accounts

AWS-managed controls are pre-marked as inherited (AWS AOC).

▶ 1. Install and Maintain Network Security Controls

c1.1 Close risky open ports in security groups

c1.2 Limit network access to and from the CDE

c1.3 Network segmentation with VPCs and multi-account architecture

c1.4 Traffic inspection with AWS Network Firewall at the CDE perimeter

c1.5 Outbound traffic control and automated remediation of network deviations

▶ 2. Apply Secure Configurations to All System Components

c2.1 Remove default credentials and configurations

c2.2 Define and enforce secure configuration standards (hardening)

c2.3 Encrypt and harden non-console administrative access

c2.4 Detect wireless access points and validate wireless configurations

▶ 3. Protect Stored Account Data

c3.1 Enable encryption at rest by default (EBS, S3, RDS)

c3.2 Minimize account data storage and do not retain SAD

c3.3 Mask PAN when displayed

c3.6 Manage the cryptographic key lifecycle with AWS KMS

c3.4 Protect cryptographic keys with AWS KMS

c3.5 Continuous account data discovery and leak prevention

▶ 4. Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

c4.1 Enforce strong TLS on public endpoints (ALB, CloudFront, API Gateway)

c4.2 Inventory and validate certificates and connection trust

c4.3 Continuous monitoring of in-transit encryption posture

▶ 5. Protect All Systems and Networks from Malicious Software

c5.1 Enable malware detection with Amazon GuardDuty

c5.2 Deploy maintained and monitored anti-malware/EDR on instances

c5.3 Anti-phishing protection with email and browsing controls

c5.4 Automated response to malware detection

▶ 6. Develop and Maintain Secure Systems and Software

c6.1 Automated vulnerability scanning with Amazon Inspector

c6.2 Patch management and controlled changes

c6.3 Protect public-facing web applications with AWS WAF

c6.4 Security built into the pipeline (DevSecOps)

c6.5 Automated vulnerability detection and remediation at scale

▶ 7. Restrict Access to System Components and Cardholder Data by Business Need to Know

c7.1 Enforce least privilege with IAM policies

c7.2 Centralize access with IAM Identity Center and role-based permissions

c7.3 Automated access review and refinement

▶ 8. Identify Users and Authenticate Access to System Components

c8.1 Require MFA for all console and CDE access

c8.5 Enforce password policy and account-lockout controls

c8.2 Unique identity and federated user lifecycle

c8.3 Eliminate long-lived credentials with temporary access

c8.4 Advanced protection of privileged identities and anomaly detection

▶ 9. Restrict Physical Access to Cardholder Data

c9.1 Inherit AWS physical controls through the compliance reports Inherited (AWS)

c9.2 Manage the physical scope of your own components (hybrid/POI)

▶ 10. Log and Monitor All Access to System Components and Cardholder Data

c10.1 Enable CloudTrail across the organization

c10.3 Reliable time synchronization (10.6)

c10.6 Keep system clocks consistent with Amazon Time Sync

c10.2 Centralize and protect logs against tampering

c10.4 Automated log review and anomaly detection

c10.5 Timely detection and alerting of critical control failures

▶ 11. Test Security of Systems and Networks Regularly

c11.1 Internal and external vulnerability scans

c11.2 Detection of unauthorized wireless access points Inherited (AWS)

c11.3 Network intrusion detection

c11.4 Detection of unauthorized changes on payment pages

c11.5 Internal and external penetration testing

▶ 12. Support Information Security with Organizational Policies and Programs

c12.1 Define the CDE scope and maintain the inventory with AWS Config

c12.2 Establish security and acceptable use policies

c12.3 Formalize risk management (targeted risk analysis)

c12.4 Security awareness program

c12.5 Third-party service provider (TPSP) risk management and shared responsibility

c12.6 Automated incident response plan