| Requirement 1 Install and Maintain Network Security Controls Build and Maintain a Secure Network and Systems 1 Quick Wins, 2 Foundational, 1 Efficient, 1 Optimized 1211 | c1.1 Close risky open ports in security groups PCI 1.2, 1.3, 1.4 Shared | c1.2 Limit network access to and from the CDE PCI 1.3, 1.4 Shared c1.3 Network segmentation with VPCs and multi-account architecture PCI 1.2, 1.3 Shared | c1.4 Traffic inspection with AWS Network Firewall at the CDE perimeter PCI 1.3, 1.4 Shared | c1.5 Outbound traffic control and automated remediation of network deviations PCI 1.3, 1.4, 1.5 Shared |
| Requirement 2 Apply Secure Configurations to All System Components Build and Maintain a Secure Network and Systems 1 Quick Wins, 2 Foundational, 1 Efficient, 0 Optimized 1210 | c2.1 Remove default credentials and configurations PCI 2.2 Shared | c2.2 Define and enforce secure configuration standards (hardening) PCI 2.2 Shared c2.3 Encrypt and harden non-console administrative access PCI 2.2 Shared | c2.4 Detect wireless access points and validate wireless configurations PCI 2.3 Customer | — |
| Requirement 3 Protect Stored Account Data Protect Account Data 1 Quick Wins, 3 Foundational, 1 Efficient, 1 Optimized 1311 | c3.1 Enable encryption at rest by default (EBS, S3, RDS) PCI 3.5 Customer | c3.2 Minimize account data storage and do not retain SAD PCI 3.2, 3.3 Customer c3.3 Mask PAN when displayed PCI 3.4 Customer c3.6 Manage the cryptographic key lifecycle with AWS KMS PCI 3.6, 3.7 Shared | c3.4 Protect cryptographic keys with AWS KMS PCI 3.6, 3.7 Shared | c3.5 Continuous account data discovery and leak prevention PCI 3.2, 3.5 Customer |
| Requirement 4 Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks Protect Account Data 1 Quick Wins, 1 Foundational, 1 Efficient, 0 Optimized 1110 | c4.1 Enforce strong TLS on public endpoints (ALB, CloudFront, API Gateway) PCI 4.2 Customer | c4.2 Inventory and validate certificates and connection trust PCI 4.2 Customer | c4.3 Continuous monitoring of in-transit encryption posture PCI 4.2 Customer | — |
| Requirement 5 Protect All Systems and Networks from Malicious Software Maintain a Vulnerability Management Program 1 Quick Wins, 1 Foundational, 1 Efficient, 1 Optimized 1111 | c5.1 Enable malware detection with Amazon GuardDuty PCI 5.2, 5.3 Shared | c5.2 Deploy maintained and monitored anti-malware/EDR on instances PCI 5.2, 5.3 Shared | c5.3 Anti-phishing protection with email and browsing controls PCI 5.4 Shared | c5.4 Automated response to malware detection PCI 5.2, 5.3 Shared |
| Requirement 6 Develop and Maintain Secure Systems and Software Maintain a Vulnerability Management Program 1 Quick Wins, 2 Foundational, 1 Efficient, 1 Optimized 1211 | c6.1 Automated vulnerability scanning with Amazon Inspector PCI 6.3 Shared | c6.2 Patch management and controlled changes PCI 6.3, 6.5 Shared c6.3 Protect public-facing web applications with AWS WAF PCI 6.4 Shared | c6.4 Security built into the pipeline (DevSecOps) PCI 6.2, 6.3 Shared | c6.5 Automated vulnerability detection and remediation at scale PCI 6.3, 6.5 Shared |
| Requirement 7 Restrict Access to System Components and Cardholder Data by Business Need to Know Implement Strong Access Control Measures 1 Quick Wins, 1 Foundational, 1 Efficient, 0 Optimized 1110 | c7.1 Enforce least privilege with IAM policies PCI 7.2, 7.3 Shared | c7.2 Centralize access with IAM Identity Center and role-based permissions PCI 7.2, 7.3 Shared | c7.3 Automated access review and refinement PCI 7.2 Shared | — |
| Requirement 8 Identify Users and Authenticate Access to System Components Implement Strong Access Control Measures 2 Quick Wins, 2 Foundational, 1 Efficient, 0 Optimized 2210 | c8.1 Require MFA for all console and CDE access PCI 8.4, 8.5 Shared c8.5 Enforce password policy and account-lockout controls PCI 8.3 Customer | c8.2 Unique identity and federated user lifecycle PCI 8.2 Shared c8.3 Eliminate long-lived credentials with temporary access PCI 8.3, 8.6 Shared | c8.4 Advanced protection of privileged identities and anomaly detection PCI 8.3, 8.5 Shared | — |
| Requirement 9 Restrict Physical Access to Cardholder Data Implement Strong Access Control Measures 1 Quick Wins, 1 Foundational, 0 Efficient, 0 Optimized 1100 | c9.1 Inherit AWS physical controls through the compliance reports PCI 9.2, 9.3 AWS | c9.2 Manage the physical scope of your own components (hybrid/POI) PCI 9.4, 9.5 Shared | — | — |
| Requirement 10 Log and Monitor All Access to System Components and Cardholder Data Regularly Monitor and Test Networks 3 Quick Wins, 1 Foundational, 1 Efficient, 1 Optimized 3111 | c10.1 Enable CloudTrail across the organization PCI 10.2 Shared c10.3 Reliable time synchronization (10.6) PCI 10.6 Shared c10.6 Keep system clocks consistent with Amazon Time Sync PCI 10.6 Shared | c10.2 Centralize and protect logs against tampering PCI 10.3, 10.5 Shared | c10.4 Automated log review and anomaly detection PCI 10.4 Shared | c10.5 Timely detection and alerting of critical control failures PCI 10.7 Shared |
| Requirement 11 Test Security of Systems and Networks Regularly Regularly Monitor and Test Networks 1 Quick Wins, 2 Foundational, 2 Efficient, 0 Optimized 1220 | c11.1 Internal and external vulnerability scans PCI 11.3 Shared | c11.2 Detection of unauthorized wireless access points PCI 11.2 AWS c11.3 Network intrusion detection PCI 11.5 Shared | c11.4 Detection of unauthorized changes on payment pages PCI 11.6 Shared c11.5 Internal and external penetration testing PCI 11.4 Shared | — |
| Requirement 12 Support Information Security with Organizational Policies and Programs Maintain an Information Security Policy 2 Quick Wins, 3 Foundational, 1 Efficient, 0 Optimized 2310 | c12.1 Define the CDE scope and maintain the inventory with AWS Config PCI 12.5 Customer c12.2 Establish security and acceptable use policies PCI 12.1, 12.2 Customer | c12.3 Formalize risk management (targeted risk analysis) PCI 12.3 Customer c12.4 Security awareness program PCI 12.6 Customer c12.5 Third-party service provider (TPSP) risk management and shared responsibility PCI 12.8 Customer | c12.6 Automated incident response plan PCI 12.10 Customer | — |
PCI DSS Security Maturity Model·AWS v1.1.0