<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# PCI DSS Controls Auditing — API Reference

## InSpec PCI DSS Resources

```bash
# Run PCI DSS InSpec profile against target
inspec exec pci-dss-profile -t ssh://user@target --reporter json:/tmp/pci.json

# Run specific requirement controls
inspec exec pci-dss-profile --controls pci-dss-1.2.1 pci-dss-3.4.1

# Validate profile structure
inspec check pci-dss-profile

# Generate profile skeleton
inspec init profile pci-dss-custom --platform os
```

## Network Segmentation Testing

```bash
# Full port scan of CDE boundary
nmap -sT -p 1-65535 --reason -oX seg-test.xml <CDE_NETWORK>

# Verify no cross-segment leakage
nmap -sT -Pn -p 3306,5432,1433,6379,27017 <NON_CDE_NETWORK>

# TLS validation on payment endpoints
openssl s_client -connect <HOST>:443 -tls1_2 2>&1 | grep -E "Protocol|Cipher"

# Check certificate expiry
openssl s_client -connect <HOST>:443 2>/dev/null | openssl x509 -noout -dates
```

## Requirement Coverage Matrix

| Req | Control Area | InSpec Resource | Automatable |
|-----|-------------|-----------------|-------------|
| 1 | Network security controls | iptables, firewall | Yes |
| 2 | Secure configurations | os_conf, service | Yes |
| 3 | Stored data protection | file, command | Partial |
| 4 | Cryptography in transit | ssl, http | Yes |
| 5 | Anti-malware | package, service | Yes |
| 6 | Secure development | file, command | Partial |
| 7 | Access control | users, groups | Yes |
| 8 | Authentication | shadow, pam | Yes |
| 9 | Physical access | — | No |
| 10 | Logging and monitoring | auditd, service | Yes |
| 11 | Security testing | command | Partial |
| 12 | Security policies | — | No |

## ASV Scanning

```bash
# Quarterly external vulnerability scan (PCI ASV)
# Typically uses approved scanning vendor tools:
nessus-cli scan --policy pci-external --target <EXTERNAL_IPS>

# Internal vulnerability scan
openvas-cli --scan-config "PCI DSS" --target <INTERNAL_NETWORK>
```
