PCI DSS with ISMS
Overview of PCI DSS mapped to the Kudo ISMS: domains, scope and equivalences between both cybersecurity frameworks.
PCI DSS v4.0 requirements organized by objective and mapped to the Kudo ISMS policies.
Objective 1 — Build and Maintain a Secure Network and Systems
📡 Communications Security Policy
Req. 1 — Network security controls: firewalls, segmentation and protection of the cardholder data environment.
🔒 Hardening Policy
Req. 2 — Secure configurations for all system components: removal of defaults and insecure configurations.
🛠️ Change and Configuration Management Policy
Req. 2 — Management and documentation of security configurations on systems and components.
Objective 2 — Protect Account Data
🛡️ Privacy Policy
Req. 3 — Protection of stored account data: minimization, masking, encryption and retention.
📦 Asset Management Policy
Req. 3 — Inventory and classification of stored cardholder data.
📡 Communications Security Policy
Req. 4 — Strong encryption of cardholder data transmitted over open public networks.
Objective 3 — Maintain a Vulnerability Management Program
🔒 Hardening Policy
Req. 5 — Malware protection: antivirus, threat detection and anti-phishing mechanisms.
👨💻 Secure Development Policy
Req. 6 — Development and maintenance of secure systems and software: vulnerability and patch management.
🛠️ Change and Configuration Management Policy
Req. 6 — Change control for systems and software that process card data.
Objective 4 — Implement Strong Access Control Measures
🔑 Access Management Policy
Req. 7, Req. 8 — Access restricted by business need, identity management and user authentication.
🏢 Physical Security Policy
Req. 9 — Restriction of physical access to cardholder data and data environment facilities.
Objective 5 — Regularly Monitor and Test Networks
📊 Logging and Monitoring Policy
Req. 10 — Logging and monitoring of all access to system components and cardholder data.
🔒 Hardening Policy
Req. 11 — Regular security testing: vulnerability scans, penetration tests and intrusion detection.
🚨 Incident Management Policy
Req. 11 — Detection of and response to unauthorized changes and security events in the data environment.
Objective 6 — Maintain an Information Security Policy
🛡️ Information Security Policy
Req. 12 — Information security policy addressing all PCI DSS requirements.
⚠️ Risk Management Policy
Req. 12 — Annual risk assessment and management of threats to the cardholder data environment.
👥 Human Resources Security Policy
Req. 12 — Personnel security management: screening, training and responsibilities.
🎓 Awareness Management Policy
Req. 12 — Security awareness program for all staff.
🤝 Vendor Management Policy
Req. 12 — Service provider management: contracts, monitoring and PCI DSS responsibilities.
🚨 Incident Management Policy
Req. 12 — Incident response plan for security incidents affecting cardholder data.