PCI Cloud Compliance Professional (PCCP) flashcards

36 cards. Read the term and the definition here. The deck at the top of this page is optional.

Cardholder Data Environment

The people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data, plus any system that is connected to or could affect the security of that environment.

Sensitive Authentication Data

Security-related information such as full magnetic stripe data, card verification codes, and PIN blocks used to authenticate cardholders. It must never be stored after authorization, even in encrypted form.

PAN Truncation

Irreversibly reducing the primary account number so the full number cannot be reconstructed. Displayed receipts may show at most the first six and last four digits, and stored truncated data falls outside cardholder data scope.

AOC

Attestation of Compliance, a form in which an assessed entity or its QSA declares the results of a PCI DSS assessment, including scope, version, validity dates, and which requirements were met.

Scope Reduction

Architectural and segmentation decisions that remove systems from the cardholder data environment or its connected-to systems, lowering assessment effort and ongoing control cost.

Future-Dated Requirements

PCI DSS v4.0 requirements that were initially best practice and became mandatory on 31 March 2025, including authenticated internal scans, targeted risk analyses, and expanded MFA.

Responsibility Matrix

A document mapping each PCI DSS requirement to the party that implements and evidences it, whether cloud customer or provider, forming the operational basis of shared responsibility.

TPSP

Third-Party Service Provider: an entity that stores, processes, or transmits cardholder data on behalf of another, or that could affect the security of cardholder data, and which must be managed under Requirement 12.8.

Provider AOC Scope Check

Verification that a cloud provider's attestation lists the exact service consumed, the PCI DSS version, valid dates, and whether assessed locations cover the regions in use.

Requirement 12.9.2

The PCI DSS requirement that service providers acknowledge in writing their responsibility for the security of cardholder data they possess and support their customers' PCI DSS compliance efforts.

IaaS Customer Obligations

In infrastructure as a service, the customer typically owns guest operating systems, middleware, applications, identity configuration, logging, and vulnerability management, while the provider secures physical and hypervisor layers.

Compensating Control

A control that meets the intent of a PCI DSS requirement when the requirement cannot be met due to a legitimate technical or documented business constraint. It must be documented, tested, and reviewed annually.

Segmentation Penetration Test

A test of segmentation controls and methods, required at least every six months and after any change, to confirm that out-of-scope systems cannot reach the cardholder data environment.

Deny-by-Default Firewall Rule

A network control posture in which all traffic is blocked unless explicitly permitted, applied to cloud security groups, network ACLs, and host firewalls protecting the cardholder data environment.

Connected-To System

A system that does not itself store, process, or transmit cardholder data but can affect the security of the cardholder data environment, such as authentication servers or logging infrastructure.

Requirement 1.5

The PCI DSS requirement stating that risks to the cardholder data environment from computing devices that are able to connect to the internet are identified and mitigated, applying equally to cloud environments.

Envelope Encryption

A scheme where data keys encrypt cardholder data and a key-encryption key wraps those data keys inside a hardware security module, so the master key never leaves the protected boundary.

Split Knowledge and Dual Control

A key-management safeguard in which no single person possesses the complete clear-text key, and at least two people are required to perform sensitive key operations.

Cryptoperiod

The defined period during which a cryptographic key is authorized for use. Keys must be changed at the end of the cryptoperiod or earlier if compromise is suspected.

Requirement 3.5.1.1

The PCI DSS requirement that the primary account number is rendered unreadable wherever it is stored, using strong cryptography, truncation, tokenization, or a one-way hash of the full number.

Key Custodian

A designated role responsible for generating, distributing, storing, rotating, and destroying cryptographic key components, with documented procedures and separated duties.

Requirement 8.4.2

The PCI DSS requirement that multi-factor authentication is implemented for all access into the cardholder data environment, covering administrative and non-administrative access alike.

Least Privilege

The principle that each identity receives only the access necessary for its defined function, enforced through role definitions, scoped policies, and periodic access reviews.

Requirement 10.4.2.1

The PCI DSS requirement that security event logs are reviewed at least daily, either manually or through automated mechanisms such as a tuned security information and event management system.

Log Retention Rule

PCI DSS requires audit log history to be retained for at least twelve months, with at least the most recent three months immediately available for analysis without restoration.

ASV Scan

An external vulnerability scan performed by a PCI SSC Approved Scanning Vendor, required at least every three months and after significant changes to external-facing infrastructure.

Authenticated Scan

An internal vulnerability scan performed with credentials so the scanner can inspect installed software and configuration, required under PCI DSS v4.0 for internal scans.

Requirement 6.3.3

The PCI DSS requirement that all system components are protected from known vulnerabilities by installing applicable security patches and updates within defined timeframes based on risk ranking.

Central Log Server

A log repository that receives audit records promptly and is hardened so that originating systems and their administrators cannot alter or delete the records they generate.

Requirement 12.10.5

The PCI DSS requirement that the incident response plan is monitored and responded to at least annually, for example through a tabletop exercise or simulation with documented results.

Requirement 12.10.4

The PCI DSS requirement that personnel responsible for responding to security incidents are available on a 24/7 basis, with defined escalation paths and contact information.

Report on Compliance

A formal assessment report produced by a Qualified Security Assessor documenting how each PCI DSS requirement was met or not met, typically required for Level 1 entities.

Evidence Sufficiency

The property of assessment evidence being complete for the whole assessment period, attributable to a control owner, timestamped, and reproducible from source systems rather than assembled as a point-in-time snapshot.

Targeted Risk Analysis

A documented analysis under PCI DSS v4.0 performed for each requirement at a defined frequency and after significant changes, used to justify the frequency and scope of security controls.

Requirement 12.8.4

The PCI DSS requirement that the entity monitors at least annually the PCI DSS compliance status of each third-party service provider it relies on within scope.

Security Awareness Program

A documented program that educates personnel on cardholder data security threats and responsibilities, reviewed at least annually, with training upon hire and at least every twelve months.