<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-pci-dss-controls
description: >-
  Audit PCI DSS v4.0 controls including network segmentation validation,
  cardholder data protection, access control enforcement, and vulnerability
  management. Automate evidence collection with InSpec profiles and OPA
  policies mapped to all 12 PCI DSS requirements.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - pci-dss
  - pci-dss-v4
  - cardholder-data
  - payment-security
  - network-segmentation
  - compliance
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Auditing PCI DSS Controls

## Overview

PCI DSS v4.0 defines 12 requirements with ~250 controls for protecting cardholder
data. This skill automates control validation across network segmentation, encryption,
access control, logging, and vulnerability management. Supports both defined and
customized approaches introduced in v4.0.

Mode: `[MODE: BLUE]` — Compliance validation with automated evidence collection.

## Prerequisites

| Requirement | Details |
|---|---|
| InSpec (`gem install inspec`) | Required |
| Nmap (`apt install nmap`) | Required |
| OpenSSL CLI | Required |
| `pip install pci-dss-scanner` | Required |

## Key Concepts

### Cardholder Data Environment Scoping

```
CDE Scope Assessment:
├── Category 1: CDE Systems (directly handle CHD)
│   ├── Payment terminals and POS systems
│   ├── Payment processing servers
│   ├── Databases storing PAN/SAD
│   └── Encryption/decryption systems
├── Category 2: Connected-to Systems
│   ├── Systems providing security services to CDE
│   ├── Systems providing network connectivity to CDE
│   └── Administration systems for CDE components
├── Category 3: Security-Impacting Systems
│   ├── Network security controls (firewalls, IDS)
│   ├── Authentication servers (LDAP, RADIUS)
│   └── Log aggregation/SIEM systems
└── Out of Scope
    ├── Properly segmented networks
    ├── Systems with no connectivity to CDE
    └── Systems validated as out-of-scope via segmentation testing
```

### InSpec Profile — PCI DSS v4.0

```ruby
# controls/pci_dss_req1.rb — Network Security Controls
control 'pci-dss-1.2.1' do
  impact 1.0
  title 'Configuration standards for network security controls'
  desc 'Network security controls are configured and maintained.'
  tag pci_dss: '1.2.1'
  tag nist: ['SC-7']

  describe iptables do
    it { should have_rule('-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT') }
    it { should have_rule('-A INPUT -p tcp --dport 22 -j DROP') }
  end
end

control 'pci-dss-1.3.1' do
  impact 1.0
  title 'Inbound traffic to CDE is restricted'
  desc 'Network security controls restrict inbound traffic to only necessary services.'
  tag pci_dss: '1.3.1'

  describe port(3306) do
    it { should_not be_listening }
    its('addresses') { should_not include '0.0.0.0' }
  end
end

# controls/pci_dss_req3.rb — Protect Stored Account Data
control 'pci-dss-3.4.1' do
  impact 1.0
  title 'PAN is secured with strong cryptography when stored'
  desc 'PAN is rendered unreadable using strong one-way hashing or encryption.'
  tag pci_dss: '3.4.1'
  tag nist: ['SC-28']

  describe command('openssl enc -aes-256-gcm -e -in /dev/null -K 00 -iv 00 2>&1') do
    its('exit_status') { should eq 0 }
  end
end

# controls/pci_dss_req8.rb — Identify Users and Authenticate
control 'pci-dss-8.3.1' do
  impact 1.0
  title 'All user access authenticated with at least one factor'
  desc 'All individual user access to system components is authenticated.'
  tag pci_dss: '8.3.1'

  describe shadow.where { password == '' } do
    its('users') { should be_empty }
  end
end

control 'pci-dss-8.3.6' do
  impact 0.7
  title 'Password complexity requirements enforced'
  desc 'Passwords meet minimum complexity: 12+ chars, numeric and alpha.'
  tag pci_dss: '8.3.6'

  describe file('/etc/security/pwquality.conf') do
    its('content') { should match(/minlen\s*=\s*1[2-9]|[2-9]\d/) }
    its('content') { should match(/dcredit\s*=\s*-1/) }
    its('content') { should match(/ucredit\s*=\s*-1/) }
  end
end

# controls/pci_dss_req10.rb — Log and Monitor All Access
control 'pci-dss-10.2.1' do
  impact 1.0
  title 'Audit logs capture all access to cardholder data'
  desc 'Audit logs record user access to in-scope system components.'
  tag pci_dss: '10.2.1'
  tag nist: ['AU-2']

  describe auditd do
    its('status') { should cmp 'enabled' }
  end

  describe auditd.where { key == 'cardholder_data' } do
    its('rules') { should_not be_empty }
  end
end
```

### Network Segmentation Validation

```bash
# Validate CDE segmentation with nmap
nmap -sT -p 1-65535 --reason -oX /tmp/seg-test.xml 10.0.1.0/24

# Verify no unauthorized paths from non-CDE to CDE
nmap -sT -Pn -p 3306,5432,1433,6379 --reason 10.0.2.0/24

# Validate firewall rules deny cross-segment traffic
iptables -L -n -v --line-numbers | grep -E "(ACCEPT|DROP).*10\.0\.[12]\."

# Test TLS configuration on payment endpoints
openssl s_client -connect payment.example.com:443 -tls1_2 \
  -cipher 'ECDHE+AESGCM:DHE+AESGCM' 2>&1 | \
  grep -E "(Protocol|Cipher|Verify)"
```

## Workflow

### Step 1: Scope CDE and Identify Systems

```bash
node scripts/agent.js --action scope --target-network 10.0.0.0/16 \
  --output /tmp/pci-scope.json
```

### Step 2: Run Control Validation

```bash
node scripts/agent.js --action audit --profile ./controls/ \
  --requirements 1,3,8,10 --output /tmp/pci-audit.json
```

### Step 3: Generate SAQ/ROC Evidence

```bash
node scripts/agent.js --action report --input /tmp/pci-audit.json \
  --format roc --output /tmp/pci-evidence.json
```

## Verification

- [ ] CDE scope documented and validated with segmentation testing
- [ ] All 12 requirements have mapped automated controls
- [ ] Network segmentation prevents unauthorized CDE access
- [ ] Encryption meets PCI DSS v4.0 standards (AES-256, TLS 1.2+)
- [ ] MFA enforced for all CDE access (Req 8.4)
- [ ] Audit logs capture all access events (Req 10)
- [ ] Quarterly ASV scans and annual penetration tests scheduled

## References

- [PCI DSS v4.0 Standard](https://www.pcisecuritystandards.org/)
- [PCI SSC Document Library](https://docs-prv.pcisecuritystandards.org/)
- [InSpec PCI Resources](https://docs.chef.io/inspec/)
