Best for: The PCI-DSS standard applies to any organization, no matter what size, that accepts, transmits, or stores cardholder data. Its scope includes all systems, networks, and applications that process, store, or transmit cardholder data, and systems used to secure and log access to them.
2.2 Develop configuration standards for all system components. Assure that these standards address all known security vulnerabilities and are consistent with industry-accepted system hardening standards
6.6 For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by methods like reviewing public-facing web applications via manual or installing an automated technical solution that detects and prevents web-based attacks (for example, a web-application firewall) in front of public-facing web applications, to continually check all traffic
The PCI Security Standards Council created it. The major credit card associations (Visa, MasterCard, American Express, Discover, JCB) established the Council as a separate organization to define practices that merchants and service providers should follow to protect cardholder data.
What systems fall within the scope of PCI DSS?
The scope includes all systems, networks, and applications that process, store, or transmit cardholder data. It also covers systems that are used to secure and log access to the systems in scope.
Is the customer still responsible for PCI DSS compliance when using Google Cloud services?
Yes, customers remain responsible for ensuring that their applications are PCI DSS compliant. Google Cloud services provide infrastructure on which customers may build services that store, process, or transmit cardholder data. A shared responsibility matrix explains the split.
How often does Google Cloud undergo a PCI DSS audit, and how can customers get the reports?
Google Cloud undergoes at least an annual third-party audit to certify individual products against the PCI DSS. PCI DSS reports may be requested via the Compliance Reports Manager for Google Cloud.
