Every PCI DSS v4.0.1 requirement and sub-requirement, mapped to the AWS security control(s) that address it. Use this to see coverage at a glance and trace each control back to the standard.
ⓘ This maps each PCI DSS v4.0.1 sub-requirement to one or more AWS security controls in this model. It shows control coverage and traceability; it is not a statement of PCI DSS compliance or certification.
Requirement 1 — Install and Maintain Network Security Controls 4/4 sub-requirements covered PCI sub-requirement AWS security controls 1.2 NSCs are configured and maintained c1.1 c1.3 1.3 Network access to and from the CDE is restricted c1.1 c1.2 c1.3 c1.4 c1.5 1.4 Network connections between trusted and untrusted networks are controlled c1.1 c1.2 c1.4 c1.5 1.5 Risks to the CDE from computing devices that connect to untrusted networks are mitigated c1.5
Requirement 2 — Apply Secure Configurations to All System Components 2/2 sub-requirements covered PCI sub-requirement AWS security controls 2.2 System components are configured and managed securely c2.1 c2.2 c2.3 2.3 Wireless environments are configured and managed securely c2.4
Requirement 3 — Protect Stored Account Data 6/6 sub-requirements covered PCI sub-requirement AWS security controls 3.2 Storage of account data is kept to a minimum c3.2 c3.5 3.3 Sensitive authentication data (SAD) is not stored after authorization c3.2 3.4 Access to displays of full PAN and the ability to copy PAN is restricted c3.3 3.5 PAN is secured wherever it is stored c3.1 c3.5 3.6 Cryptographic keys used to protect stored account data are secured c3.4 c3.6 3.7 Key-management processes and procedures for cryptographic keys are defined and implemented c3.4 c3.6
Requirement 4 — Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks 1/1 sub-requirements covered PCI sub-requirement AWS security controls 4.2 PAN is protected with strong cryptography during transmission c4.1 c4.2 c4.3
Requirement 5 — Protect All Systems and Networks from Malicious Software 3/3 sub-requirements covered PCI sub-requirement AWS security controls 5.2 Malicious software is prevented, or detected and addressed c5.1 c5.2 c5.4 5.3 Anti-malware mechanisms and processes are active, maintained, and monitored c5.1 c5.2 c5.4 5.4 Anti-phishing mechanisms protect users against phishing attacks c5.3
Requirement 6 — Develop and Maintain Secure Systems and Software 4/4 sub-requirements covered PCI sub-requirement AWS security controls 6.2 Bespoke and custom software is developed securely c6.4 6.3 Security vulnerabilities are identified and addressed c6.1 c6.2 c6.4 c6.5 6.4 Public-facing web applications are protected against attacks c6.3 6.5 Changes to all system components are managed securely c6.2 c6.5
Requirement 7 — Restrict Access to System Components and Cardholder Data by Business Need to Know 2/2 sub-requirements covered PCI sub-requirement AWS security controls 7.2 Access to system components and data is appropriately defined and assigned c7.1 c7.2 c7.3 7.3 Access is managed via an access control system(s) c7.1 c7.2
Requirement 8 — Identify Users and Authenticate Access to System Components 5/5 sub-requirements covered PCI sub-requirement AWS security controls 8.2 User identification and related accounts are managed throughout their lifecycle c8.2 8.3 Strong authentication for users and administrators is established and managed c8.3 c8.4 c8.5 8.4 Multi-factor authentication (MFA) is implemented to secure access into the CDE c8.1 8.5 MFA systems are configured to prevent misuse c8.1 c8.4 8.6 Use of application and system accounts and associated authentication factors is managed c8.3
Requirement 9 — Restrict Physical Access to Cardholder Data 4/4 sub-requirements covered PCI sub-requirement AWS security controls 9.2 Physical access controls manage entry into facilities and systems c9.1 9.3 Physical access for personnel and visitors is authorized and managed c9.1 9.4 Media with cardholder data is securely stored, accessed, distributed, and destroyed c9.2 9.5 Point-of-interaction (POI) devices are protected from tampering and unauthorized substitution c9.2
Requirement 10 — Log and Monitor All Access to System Components and Cardholder Data 6/6 sub-requirements covered PCI sub-requirement AWS security controls 10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity c10.1 10.3 Audit logs are protected from destruction and unauthorized modifications c10.2 10.4 Audit logs are reviewed to identify anomalies or suspicious activity c10.4 10.5 Audit log history is retained and available for analysis c10.2 10.6 Time-synchronization mechanisms support consistent time settings c10.3 c10.6 10.7 Failures of critical security control systems are detected, reported, and responded to promptly c10.5
Requirement 11 — Test Security of Systems and Networks Regularly 5/5 sub-requirements covered PCI sub-requirement AWS security controls 11.2 Wireless access points are identified and monitored, and unauthorized wireless access points are addressed c11.2 11.3 External and internal vulnerabilities are regularly identified, prioritized, and addressed c11.1 11.4 External and internal penetration testing is regularly performed c11.5 11.5 Network intrusions and unexpected file changes are detected and responded to c11.3 11.6 Unauthorized changes on payment pages are detected and responded to c11.4
Requirement 12 — Support Information Security with Organizational Policies and Programs 7/7 sub-requirements covered PCI sub-requirement AWS security controls 12.1 A comprehensive information security policy is established, published, maintained, and disseminated c12.2 12.2 Acceptable use policies for end-user technologies are defined and implemented c12.2 12.3 Risks to the CDE are formally identified, evaluated, and managed c12.3 12.5 PCI DSS scope is documented and validated c12.1 12.6 Security awareness education is an ongoing activity c12.4 12.8 Risk to information assets associated with third-party service provider (TPSP) relationships is managed c12.5 12.10 Suspected and confirmed security incidents are responded to immediately c12.6
