mcpField
P
pci-dss-scoping

pci-dss-scoping

github.com/securityskillsSecurity0496 installsUpdated 9w ago
Repository

About pci-dss-scoping

A skill for planning PCI DSS compliance scope, helping security and compliance teams trace cardholder data flows, define the CDE, and assess network segmentation. It also outlines v4.0 requirement mapping and evidence preparation.

Key features

  1. 01Trace cardholder data flows
  2. 02Identify the CDE and connected systems
  3. 03Document and verify segmentation
  4. 04Map PCI DSS v4.0 requirements
  5. 05Organize assessment evidence

Use cases

  1. 01Prepare a PCI DSS scope document
  2. 02Plan a segmentation penetration test
  3. 03Assemble an audit evidence matrix

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/securityskills/skills --skill pci-dss-scoping

After installing, type/pci-dss-scopingin Claude Code to confirm it loaded.

Details

From the project README

PCI DSS Scoping

Correct scoping is 80% of PCI DSS. Get the data flows right first.

1. Find the Cardholder Data

  • Trace the full payment path: capture → transmission → processing → storage → destruction
  • PAN storage locations: databases, logs (log scrubbing!), backups, email/ticket systems, dev/test environments
  • Verify truncation/masking everywhere PAN appears; confirm no SAD (sensitive auth data) persistence post-authorization

2. Define the CDE

  • Cardholder Data Environment: all systems that store/process/transmit CHD, plus connected systems
  • Identify connected-to systems: security-impacting (shared services like AD, DNS, NTP, monitoring) and security-impacting-or-not based on their ability to impact CDE security
  • Everything with potential CDE connectivity is in scope until segmentation is proven

3. Segmentation (the scope killer)

  • Document segmentation controls: firewalls, network access control, separate credentials/privileged accounts for CDE
  • Segmentation penetration test is mandatory (v4.0): verify from out-of-scope zones that CDE boundaries hold, both directions
  • If no segmentation: entire network is the CDE. Usually more expensive than segmenting.

4. Requirements Mapping (v4.0 highlights)

  • Req 1/2: network controls, secure configurations (now with defined "defined approach" targets)
  • Req 3: protect stored account data; cryptography inventory and key management (3.6/3.7 expanded)
  • Req 4: strong cryptography in transit — new in v4.0: PAN over open networks needs rendering unreadable (4.2.1)
  • Req 8: MFA for all access into CDE (8.4 expanded beyond admin)
  • Req 10/11: logging + testing; targeted risk analysis for customizing frequencies (11.3.x)
  • Req 12: policy, third-party/service provider management, customizes approaches documented

5. Evidence Preparation

  • ASV scan reports, internal/external pentest reports, segmentation pen test
  • Quarterly scans, configuration standards, key management records, training logs
  • compensating controls worksheet for any "not applicable" requirements

Output

Data-flow diagrams, scope document with in/out-of-scope justification, segmentation test plan, and a requirements evidence matrix.

Comments

Markdown supported