CGPulse

Sign In

PCI DSS v4.0

Azure 44 automated checks

Payment Card Industry Data Security Standard v4.0 compliance checks for cloud resources

Access Control

Key Vault should use RBAC authorization 7.2.1 · Medium
Container Registry must disable admin user 7.2.2 · High

Authentication

SQL Server should use Azure AD-only authentication 8.3.1 · High
Cosmos DB should disable local authentication 8.3.1 · High

Data Protection

Storage account should use customer-managed keys 3.5.1 · Medium
Key Vault must enable purge protection 3.6.1 · High

Encryption in Transit

Storage account must enforce HTTPS transfer 4.2.1 · High
Redis Cache must disable non-SSL port 4.2.1 · High
SQL Server must use TLS 1.2 or higher 4.2.1 · High

Incident Response

Organization should maintain a PCI incident response plan 12.10.1 · Critical
Organization should test the incident response plan annually 12.10.2 · High

Logging & Monitoring

Key Vault should disable public network access 10.3.1 · High

Malware Protection

Virtual Machine must have endpoint protection installed 5.2.1 · High

Network Security

NSG must have security rules configured to restrict inbound traffic 1.3.1 · Critical
Storage account must deny public network access by default 1.3.2 · High
SQL Server should disable public network access 1.3.2 · High
Organization should maintain current network diagrams 1.1.2 · High
Organization should maintain cardholder data flow diagrams 1.1.3 · High

Personnel Security

Organization should perform background checks for CDE access personnel 12.7 · High

Physical Security

IAM password policy must require minimum length of 14 9.2.1 · Medium
Organization should implement physical access controls to the CDE 9.1 · High
Organization should securely destroy cardholder data media 9.4 · High

Requirement 11: Test Security

Organization should have a vulnerability management program 11.3 · High

Requirement 12: Security Policies

Organization should have a documented incident response plan 12.10 · High
Organization should conduct security awareness training 12.6 · Medium

Requirement 6: Secure Systems

Organization should have a formal change management process 6.5 · Medium

Requirement 7: Restrict Access

Organization should perform periodic access reviews 7.2 · High

Requirement 9: Physical Access

Organization should implement physical security controls 9.1 · Medium

Risk Assessment

Organization should conduct annual PCI risk assessments 12.2 · High

Secure Configuration

App Service must use TLS 1.2 or higher 2.2.7 · High
App Service must disable FTP or require FTPS only 2.2.7 · High

Secure Development

App Service should enable HTTP/2 6.2.4 · Low
Organization should implement a secure software development lifecycle 6.3 · High

Security Awareness

Organization should conduct security awareness training for all personnel 12.6 · High

Security Policies

IAM password policy must require minimum length of 14 12.1.1 · Medium
IAM password policy must require minimum length of 14 12.6.1 · Medium

Security Policy

Organization should assign PCI DSS security responsibilities 12.1.1 · High
Organization should maintain a comprehensive information security policy 12.1 · High

Security Testing

IAM password policy must require minimum length of 14 11.3.1 · Medium
IAM password policy must require minimum length of 14 11.4.1 · Medium

Service Providers

Organization should manage service provider PCI compliance 12.8 · High

Testing

Organization should conduct penetration testing at least annually 11.4 · Critical
Organization should perform quarterly vulnerability scans 11.3 · High
Organization should implement change detection mechanisms 11.5 · Medium

Measure your PCI DSS v4.0 posture

CGPulse maps live Azure and AWS findings to these controls and tracks drift over time.

Start free scan

Official framework documentation