# Pci Dss Compliance

Implement PCI DSS requirements for payment card data.

- Repository: https://github.com/BagelHole/DevOps-Security-Agent-Skills (1187 stars)
- Category: Security
- License: MIT
- Last updated: 2026-05-22
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill pci-dss-compliance -g -a claude-code -y`
Codex: `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill pci-dss-compliance -g -a codex -y`
Cursor: `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill pci-dss-compliance -g -a cursor -y`
Gemini CLI: `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill pci-dss-compliance -g -a gemini-cli -y`

## Description

Implement PCI DSS requirements for payment card data. Configure cardholder data environment and security controls. Use when processing payment cards.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# PCI DSS Compliance

Implement PCI DSS v4.0 requirements for protecting cardholder data across the Cardholder Data Environment (CDE), including network segmentation, encryption, access controls, and ongoing testing.

## When to Use

- Processing, storing, or transmitting payment card data
- Scoping the Cardholder Data Environment for PCI assessment
- Selecting the appropriate Self-Assessment Questionnaire (SAQ)
- Implementing network segmentation to reduce CDE scope
- Preparing for QSA assessment or ASV scanning

## SAQ Types and Applicability

```yaml
saq_types:
  SAQ_A:
    description: "Card-not-present merchants using fully outsourced payment"
    applies_when:
      - All payment processing fully outsourced to PCI-compliant third party
      - No electronic storage, processing, or transmission of cardholder data
      - Only payment page redirects or iframes from compliant provider
    requirements: ~22 questions

  SAQ_A_EP:
    description: "E-commerce merchants with website that affects payment security"
    applies_when:
      - E-commerce channel only
      - Website controls redirect to or loads payment page from third party
      - No direct processing but website could affect transaction security
    requirements: ~191 questions

  SAQ_B:
    description: "Merchants with only imprint machines or standalone terminals"
    applies_when:
      - Only standalone POS terminals (dial-out or IP connected)
      - No electronic cardholder data storage
      - No e-commerce channel
    requirements: ~41 questions

  SAQ_C:
    description: "Merchants with payment application systems connected to internet"
    applies_when:
      - Payment application connected to internet
      - No electronic cardholder data storage
      - No e-commerce channel
    requirements: ~160 questions

The rest: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/HEAD/compliance/frameworks/pci-dss-compliance/SKILL.md