PCI DSS：AI-FW 控制与组织责任
了解框架义务、AI-FW 技术控制和组织责任。
PCI DSS：AI-FW 控制与组织责任 · 已生效
本页说明框架与 AI-FW 的关系。产品支持部分运行时控制，但不替代组织的合规或审计责任。
AI-FW 的定位
- 说明：PCI DSS scope depends on the cardholder data environment. AI-FW can detect configured card patterns, mask or block and log metadata, but cannot define scope or certify compliance.
产品不负责的事项
- 说明：Defining the complete CDE and connected systems.
- 说明：Performing PCI assessment, SAQ, ROC or certification.
- 说明：Guaranteeing PAN never enters other paths, logs or tools.
- 说明：Replacing network segmentation, access or incident controls.
- 说明：Determining SAQ eligibility.
控制映射
- 说明：CDE scope: 说明：Identify systems handling card data or affecting the CDE. AI-FW: 说明：Model inventory helps document the AI route.
- 说明：Data protection: 说明：Reduce PAN exposure and storage. AI-FW: 说明：Configured rules can mask or block before egress.
- 说明：Access: 说明：Limit access to authorised systems. AI-FW: 说明：API key/JWT/mTLS identity and agent policy.
- 说明：Audit: 说明：Record and review activity. AI-FW: 说明：Auditable logs and configured export.
证据预期
- 说明：Card rules: 说明：Patterns, state, actions and test results.
- 说明：Gateway usage: 说明：Models and destinations receiving requests.
- 说明：Identity: 说明：Calls attributed to authenticated users or agents.
组织责任
- 说明：Determine CDE scope and PAN flows.
- 说明：Validate architecture with a PCI adviser.
- 说明：Test detection and review other data paths.
- 说明：Maintain PCI controls and assessment processes.
- 说明：Manage incidents under PCI procedures.
常见问题
说明：Does masking PAN remove PCI scope?
说明：No. Scope depends on flows and connectivity and requires formal assessment.
说明：Does detection guarantee PAN cannot leave?
说明：No. Test patterns and consider channels outside the gateway.
说明：Does AI-FW certify PCI DSS?
说明：No. It may provide limited technical evidence, not certification.
一般信息，不构成法律或审计建议。