PCI DSS: controles y responsabilidades
Conozca obligaciones, controles técnicos y responsabilidades organizativas.
PCI DSS: controles y responsabilidades · En vigor
Esta página explica controles AI-FW sin reemplazar las responsabilidades de cumplimiento o auditoría.
Dónde encaja AI-FW
- Nota: PCI DSS scope depends on the cardholder data environment. AI-FW can detect configured card patterns, mask or block and log metadata, but cannot define scope or certify compliance.
Lo que el producto no hace
- Nota: Defining the complete CDE and connected systems.
- Nota: Performing PCI assessment, SAQ, ROC or certification.
- Nota: Guaranteeing PAN never enters other paths, logs or tools.
- Nota: Replacing network segmentation, access or incident controls.
- Nota: Determining SAQ eligibility.
Controles relacionados
- Nota: CDE scope: Nota: Identify systems handling card data or affecting the CDE. AI-FW: Nota: Model inventory helps document the AI route.
- Nota: Data protection: Nota: Reduce PAN exposure and storage. AI-FW: Nota: Configured rules can mask or block before egress.
- Nota: Access: Nota: Limit access to authorised systems. AI-FW: Nota: API key/JWT/mTLS identity and agent policy.
- Nota: Audit: Nota: Record and review activity. AI-FW: Nota: Auditable logs and configured export.
Evidencias
- Nota: Card rules: Nota: Patterns, state, actions and test results.
- Nota: Gateway usage: Nota: Models and destinations receiving requests.
- Nota: Identity: Nota: Calls attributed to authenticated users or agents.
Responsabilidades de la organización
- Nota: Determine CDE scope and PAN flows.
- Nota: Validate architecture with a PCI adviser.
- Nota: Test detection and review other data paths.
- Nota: Maintain PCI controls and assessment processes.
- Nota: Manage incidents under PCI procedures.
Preguntas frecuentes
Nota: Does masking PAN remove PCI scope?
Nota: No. Scope depends on flows and connectivity and requires formal assessment.
Nota: Does detection guarantee PAN cannot leave?
Nota: No. Test patterns and consider channels outside the gateway.
Nota: Does AI-FW certify PCI DSS?
Nota: No. It may provide limited technical evidence, not certification.
Información general, no es asesoramiento legal ni de auditoría.