security-compliance-payment

What problem does it solve?

This Skill helps developers and organizations ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS 4.0.1) for payment processing, minimizing PCI surface area and providing evidence for QSA assessments.

Core Features & Use Cases

• SAQ Selection: Determines the appropriate SAQ type based on the project's architecture and data handling.
• Scope Reduction: Recommends architectural changes to minimize PCI scope.
• Data Handling: Provides guidelines for handling sensitive cardholder data to prevent data breaches.
• Tokenization: Ensures proper use of payment service provider (PSP) tokenization to protect cardholder data.
• Payment Flow Architecture Review: Validates payment flow architecture against PCI DSS requirements.
• Cryptography and Access Control: Ensures secure transmission and storage of cardholder data with strong cryptography and access controls.
• Logging and Monitoring: Sets up logging and monitoring for CDE systems to detect and respond to security incidents.
• Vendor Management: Assesses the security posture of payment service providers.
• Incident Response: Provides guidance on incident response for cardholder data breaches.

Quick Start

Activate the security-compliance-payment skill whenever payment processing is in scope.