PCI Cloud Compliance Professional (PCCP) key terms

The people, processes, and technology that store, process, or transmit account data, plus any connected system that could affect its security. In cloud, it spans provider and customer systems, so scoping decisions determine assessment boundaries.

Cardholder data (PAN plus cardholder name, expiry, or service code) together with sensitive authentication data such as full track data, CAV2/CVC2/CVV2/CID, and PINs or PIN blocks. Sensitive authentication data must not be stored after authorization.

A system that is not part of the CDE but can impact the security of the CDE, for example through shared infrastructure, authentication, or network paths. Cloud shared services often land here and require justification if excluded.

The deliberate shrinking of PCI DSS assessment scope through techniques such as tokenization, network segmentation, and limiting where account data lives. In cloud it usually means isolating payment workloads from shared accounts and networks.

Replacing a PAN with a surrogate value that has no exploitable relationship to the original. When tokens are used only outside the CDE and cannot be reversed without strong controls, scope can shrink substantially.

Storing only part of the primary account number, with the display maximum being the first six and last four digits. Truncated PANs are still cardholder data but reduce risk and are permitted where full PAN storage is not required.

The division of security duties between a cloud provider and its customer. The provider secures the underlying infrastructure, while the customer secures data, identities, configurations, and workloads. PCI DSS obligations must be mapped explicitly to each side.

A document mapping each PCI DSS requirement to the party that implements and evidences it, such as provider, customer, or joint. It prevents gaps and duplicated effort during assessments and vendor reviews.

A signed statement from a cloud provider summarizing its PCI DSS assessment results and covered services. Customers use it to understand which requirements the provider meets and which remain their responsibility.

A formal evaluation of an entity's compliance with PCI DSS requirements, performed by a Qualified Security Assessor or through self-assessment, depending on merchant or service provider level.

An individual employed by a PCI Security Standards Council-certified company and qualified to assess compliance with PCI DSS. QSAs produce Reports on Compliance and can assess cloud-hosted environments.

The detailed assessment report produced by a QSA documenting how each PCI DSS requirement was met, including evidence, sampling, and compensating controls. Cloud assessments must clearly state which components were assessed.

A validation tool that eligible merchants and service providers complete to attest compliance without a QSA-led assessment. The correct SAQ type depends on how card data is accepted, stored, and transmitted.

A form accompanying an ROC or SAQ in which the entity declares its compliance status and scope. It is the primary document customers request from cloud providers and payment vendors.

Dividing networks into zones with controlled traffic between them so that systems outside the CDE cannot reach card data systems. Effective segmentation can remove systems from scope, but it must be tested and documented.

Enforcing fine-grained, workload-level traffic policy rather than relying only on network boundaries. In cloud it is often implemented with security groups, service meshes, or host firewalls to isolate payment workloads.

A virtual firewall attached to cloud resources that permits or denies traffic based on rules. Security groups are stateful and must be reviewed regularly because permissive rules can silently expand CDE scope.

An isolated virtual network within a public cloud, with its own address ranges, subnets, and routing. Segmentation design typically starts with separate VPCs or subnets for card data workloads.

Protecting stored data with cryptography so that disk or object access alone does not reveal plaintext. PCI DSS requires documented key management and protection of cryptographic keys wherever encryption is used to reduce scope.

Protecting data moving across networks using protocols such as TLS, with strong versions and cipher suites. Cloud architectures must prevent fallback to cleartext between load balancers, services, and data stores.

Encrypting data with a data key, then encrypting that data key with a longer-lived master key. This pattern limits exposure of master keys and is standard in cloud key management services.

A managed service that creates, stores, and controls access to cryptographic keys and performs encryption operations. Access policies on KMS keys are themselves critical controls that assessors examine closely.

A tamper-resistant device that generates and stores keys and performs cryptographic operations. Cloud HSM offerings support key custody requirements and separation of duties for sensitive payment workloads.

Periodically replacing cryptographic keys and retiring old ones according to a documented policy. Cloud KMS services often automate rotation, but assessors still expect defined cryptoperiods and evidence of the process.

The policies and systems that decide who can access which cloud resources and under what conditions. Least privilege, role separation, and unique identities are core expectations in cloud PCI DSS assessments.

Granting only the permissions needed for a role to perform its function, and no more. In cloud, overly broad IAM policies and wildcard permissions are common findings during assessments.

Requiring two or more independent authentication factors to verify identity. PCI DSS v4.0 expands MFA requirements to all access into the CDE and to many administrative and remote access scenarios.

Access held by accounts that can change configurations, security settings, or data at a high level, such as cloud administrators. These accounts require stricter controls, monitoring, and review than ordinary user accounts.

Automated checks that identify known weaknesses in systems and applications. PCI DSS requires internal and external scanning at defined intervals and after significant changes, with remediation and rescanning of high-risk findings.

A company authorized by the PCI Security Standards Council to perform external vulnerability scans that satisfy PCI DSS requirement 11. Scans must pass and be repeated quarterly.

Authorized simulated attacks that test whether controls can be bypassed. PCI DSS v4.0 requires testing of segmentation controls and application and network layers at defined frequencies by qualified testers.

The process of identifying, testing, deploying, and verifying security updates within defined timeframes based on risk. Cloud images and managed services still require customer patching of guest systems and applications.

A documented, hardened set of settings applied to systems and services, such as disabling defaults and unnecessary features. Cloud baselines must cover both provider services and customer-managed workloads.

Defining and provisioning cloud resources through versioned configuration files rather than manual steps. IaC supports repeatable hardened builds but must be scanned to prevent insecure configurations reaching production.

Continuously comparing deployed resources against the approved configuration baseline to find unauthorized or accidental changes. Drift can quietly break segmentation or encryption settings between assessments.

Collecting logs from many systems into a protected, tamper-resistant repository for review and retention. PCI DSS requires retention of at least twelve months with three months immediately available for analysis.

A platform that aggregates, correlates, and alerts on security events from many sources. In cloud, SIEM coverage must include control-plane audit logs, not just guest operating system logs.

Provider-generated records of control-plane activity such as configuration changes, key use, and identity actions. They are essential evidence for monitoring and investigations but must be enabled and protected by the customer.

Documented procedures for detecting, containing, eradicating, and recovering from security incidents, including roles and communications. Cloud incidents require knowing how to engage the provider and preserve volatile evidence.

Capturing and protecting logs, snapshots, and memory images in a way that keeps them reliable for investigation. Cloud snapshots and immutable log stores help, but chain of custody must be documented.

An entity that stores, processes, transmits, or can affect the security of cardholder data on behalf of another organization. Cloud providers are TPSPs, and their compliance must be monitored and documented.

The ongoing process of assessing, monitoring, and reviewing third-party providers for security and compliance risk. It includes reviewing attestations, tracking changes in scope, and defining contractual security obligations.

Alternative safeguards that meet the intent of a PCI DSS requirement when the stated control cannot be applied due to a legitimate technical or business constraint. They must be documented, validated, and reviewed.