payments

PCI DSS

Payment Card Industry Data Security Standard — scope, controls, and compliance

PCI DSS — Overview

Payment Card Industry Data Security Standard — scope, controls, and compliance

PCI DSS v4.0 mandates 12 requirements: firewall, no default passwords, protect stored cardholder data, encrypt transmission, anti-virus, secure systems, restrict access, unique IDs, physical access, logging, vulnerability scans, and security policy. Scope reduction via tokenization and P2PE is critical.

# PCI DSS Scope Reduction Architecture
[Card Data] → [P2PE Terminal] → [Token only to app]
                    ↓
              [Token Vault / HSM]
                    ↓
              [Kafka: tokenized events only]

# Never in logs, Kafka, or DB:
# - Full PAN
# - CVV/CVC
# - Magnetic stripe data

# Spring Boot — reject raw PAN in DTO
@Pattern(regexp = "^tok_[a-zA-Z0-9]+$")
private String cardToken; // Only tokens in application layer

Tip: SAQ type depends on architecture: SAQ A for fully outsourced card handling, SAQ D for custom payment apps touching card data.