PCI Cloud Compliance Professional (PCCP) case studies

PCCP · Put your knowledge to work in context.

The PCI Cloud Compliance Professional (PCCP) is an independent, vendor-neutral credential for practitioners who assess, implement, or manage Payment Card Industry Data Security Standard (PCI DSS) compliance in cloud environments. It suits cloud security engineers, compliance analysts, QSAs and internal assessors, and architects who translate PCI DSS v4.0 requirements into cloud-native controls. The PCCP case studies are 5 cases and about 4,083 words.

Scoping a Hosted Payment Page Store That Also Keeps PAN

Northwind Outfitters runs a $180 million online store. Last quarter it replaced its self-hosted payment form with a hosted payment page from its acquirer, embedded as an iframe on checkout.northwind.com.

874 words, about 4 min 2

A VPC Peering That Quietly Reconnects the CDE to Corporate

Vantage Grocers operates 600 stores and an e-commerce platform. The CDE sits in AWS account A: a production VPC at 10.20.0.0/16 containing an Aurora cluster with PAN, 40 EC2 application servers and an ELB.

619 words, about 3 min 3

Envelope Encryption With Copied Keys and No Custodian Paper Trail

Arcadia Pay processes card-not-present payments and stores encrypted PAN in a 400 TB S3 data lake. It uses AWS KMS customer-managed keys in three regions with envelope encryption: each object has an AES-256 data key wrapped by a regional CMK.

811 words, about 4 min 4

Container Patching, Scanner Blind Spots and a WAF That Blocks the ASV

Ridgeline Travel runs 300 microservices on EKS across 60 nodes, with 1,200 images in ECR pulled from public base images. ECR basic scanning runs on push only, so images deployed eight months ago have never been rescanned for CVEs published since.

899 words, about 4 min 5

An Expiring Provider AOC, a New Region and Thin Evidence

Meridian Fitness runs 220 clubs plus e-commerce billing and is preparing an annual ROC. Its IaaS provider, CloudCo, has supplied an AOC that covers IaaS and lists which requirements are inherited, but it expires two months before Meridian's ROC is due to be issued and does not mention the managed database service Meridian uses for PAN.

880 words, about 4 min