Azure Compliance FrameworksRetired Frameworks
PCI DSS v3.2.1
Deprecated Framework
This framework has been superseded by PCI DSS v4.0. Organizations should migrate to the newer version, which became mandatory for compliance assessments after March 31, 2024.
The Payment Card Industry Data Security Standard (PCI DSS) version 3.2.1 is an information security standard for organizations that handle branded credit cards from major card schemes. Maintained by the PCI Security Standards Council, this version provides requirements for securing cardholder data including network security, access control, and vulnerability management. It applies globally to all entities that store, process, or transmit cardholder data including merchants, processors, acquirers, issuers, and service providers.
| Mandatory? | Mandatory for any entity processing card data |
| Who validates? | QSA (Level 1 merchants/SPs); SAQ self-assessment (Levels 2–4) |
| Renewal | Annual |
| Scope | Cardholder data environment (CDE) and connected systems |
Controls by Category
1.3 Prohibit direct public access between the Internet and any system component in the cardholder data environment (1 control)
1.3.2: Limit inbound Internet traffic to IP addresses within the DMZ. (2 controls)
1.3.4: Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet. (2 controls)
10.1 Implement audit trails to link all access to system components to each individual user. (1 control)
10.2 Implement automated audit trails for all system components to reconstruct the events (1 control)
10.2.2 All actions taken by any individual with root or administrative privileges (1 control)
10.2.7 Creation and deletion of system-level objects (1 control)
10.5.4: Write logs for external-facing technologies onto a secure, centralized, internal log server or media device. (3 controls)
11.2.1: Perform quarterly internal vulnerability scans and rescans as needed, until all “high-risk” vulnerabilities (as identified in Requirement 6.1) are resolved. Scans must be performed by qualified personnel. (3 controls)
3.2: Do not store sensitive authentication data after authorization (even if it is encrypted). Render all sensitive authentication data unrecoverable upon completion of the authorization process. Issuers and related entities may store sensitive authentication data if there is a business justification, and the data is stored securely. (5 controls)
Azure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedSQL servers should have an Azure Active Directory administrator configured
3.4: Render PAN unreadable anywhere it is stored - including on portable digital media, backup media, in logs, and data received from or stored by wireless networks. Technology solutions for this requirement may include strong one-way hash functions of the entire PAN, truncation, index tokens with securely stored pads, or strong cryptography. (7 controls)
App Service API apps should require HTTPS for all accessFunction apps should require HTTPS for all accessAutomation account variables should have encryption enabledAzure Cache for Redis should allow only secure connectionsService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignSQL databases should have transparent data encryption enabledStorage accounts should have secure transfer enabled
4.1: Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks (eg. Internet, wireless technologies, cellular technologies, General Packet Radio Service [GPRS], satellite communications). Ensure wireless networks transmitting cardholder data or connected to the cardholder data environment use industry best practices to implement strong encryption for authentication and transmission. (7 controls)
App Service API apps should require HTTPS for all accessFunction apps should require HTTPS for all accessAutomation account variables should have encryption enabledAzure Cache for Redis should allow only secure connectionsService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignSQL databases should have transparent data encryption enabledStorage accounts should have secure transfer enabled
5.1: Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers). For systems not affected commonly by malicious software, perform periodic evaluations to evaluate evolving malware threats and confirm whether such systems continue to not require anti-virus software. (3 controls)
6.2: Protect all system components and software from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release. (3 controls)
6.5.3: Insecure cryptographic storage. (7 controls)
App Service API apps should require HTTPS for all accessFunction apps should require HTTPS for all accessAutomation account variables should have encryption enabledAzure Cache for Redis should allow only secure connectionsService Fabric clusters should have the ClusterProtectionLevel property set to EncryptAndSignSQL databases should have transparent data encryption enabledStorage accounts should have secure transfer enabled
6.6: Ensure all public-facing web applications are protected against known attacks, either by performing application vulnerability assessment at least annually and after any changes, or by installing an automated technical solution that detects and prevents web-based attacks (for example, a web-application firewall) in front of public-facing web applications, to continually check all traffic. (3 controls)
7.1.1: Define access needs for each role, including: - System components and data resources that each role needs to access for their job function - Level of privilege required (for example, user, administrator, etc.) for accessing resources. (2 controls)
7.1.2: Restrict access to privileged user IDs to least privileges necessary to perform job responsibilities. (2 controls)
7.1.3: Assign access based on individual personnel's job classification and function. (2 controls)
7.2.1: Coverage of all system components. (5 controls)
Azure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedSQL servers should have an Azure Active Directory administrator configured
8.1.2: Control addition, deletion, and modification of user IDs, credentials, and other identifier objects. (5 controls)
Azure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissions
8.1.3: Immediately revoke access for any terminated users. (2 controls)
8.1.5: Manage IDs used by thid parties to access, support, or maintain system components via remote access. Remote access are as follows: - Enabled only during the time period needed and disabled when not in use. - Monitored when in use. (5 controls)
Azure subscriptions should not have blocked accounts with read and write permissionsAzure subscriptions should not have blocked accounts with owner permissionsAzure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissions
8.2.3: Passwords/phrases must meet the following: - Require a minimum length of at least seven characters. - Contain both numeric and alphabetic characters. Alternatively, the passwords/phrases must have complexity and strength at least equivalent to the parameters specified above. (6 controls)
Windows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should have maximum password age set to 70 daysWindows machines should have minimum password length set to 14 charactersWindows machines should prohibit reuse of the previous 24 passwords
8.2.5: Do not allow an individual to submit a new password/phrase that is the same as any of the last four passwords/phrases he or she has used. (6 controls)
Windows virtual machines should have the Windows Guest Configuration extension installed for assignmentsVirtual machines with no identities should use system-assigned managed identity for Guest Configuration assignmentsVirtual machines with a user-assigned identity should also use system-assigned managed identity for Guest Configuration assignmentsWindows machines should have maximum password age set to 70 daysWindows machines should have minimum password length set to 14 charactersWindows machines should prohibit reuse of the previous 24 passwords
8.3.1: Incorporate multi-factor authentication for all non-console access into the CDE for personnel with administrative access. (5 controls)
Azure subscriptions should not have guest accounts with owner permissionsAzure subscriptions should not have guest accounts with read permissionsAzure subscriptions should not have guest accounts with write permissionsCustom RBAC roles should not be usedSQL servers should have an Azure Active Directory administrator configured
Related Frameworks
NIST SP 800-171 Rev 2 — 🟢 High overlap (85%)
NIST SP 800-53 Rev 5 — 🟢 High overlap (85%)
FedRAMP High — 🟢 High overlap (79%)