PCI CFA key terms

The people, processes, and technology that store, process, or transmit account data, plus any connected systems that could affect the security of that data. Its exact boundary drives the scope of every PCI DSS assessment and forensic investigation.

Cardholder data (PAN, cardholder name, expiration date, service code) combined with sensitive authentication data such as full track data, CAV2/CVC2/CVV2/CID, and PINs or PIN blocks. Sensitive authentication data must not be stored after authorization.

The payment card number that identifies the issuer and account. It is the defining element of cardholder data, and its storage must be masked, truncated, or rendered unreadable when displayed or retained.

Security-related data used to authenticate the card and cardholder, including full magnetic-stripe or chip data, card verification codes, and PINs or PIN blocks. It may be stored only when needed for authorization and must otherwise be protected from retention.

All system components that store, process, or transmit account data, and those connected to or able to impact the security of such components. Correct scope determination prevents both under-protection and unnecessary assessment cost.

Isolating systems that handle account data from other networks using controls such as firewalls, VLANs, and access rules, so that out-of-scope systems cannot reach the CDE. Segmentation must be verified and documented, not assumed.

Architectural and process changes that remove systems or data from PCI DSS scope, such as tokenization, outsourcing, or segmentation. Reductions must be validated with evidence before they can be relied upon.

Replacing a PAN with a surrogate value that has no exploitable relationship to the original card number, so systems handling only tokens fall outside cardholder data scope. Token security depends on protecting the mapping vault.

The process of locating where account data actually resides across servers, endpoints, databases, backups, and logs. It exposes shadow storage and unapproved retention that written data-flow diagrams often miss.

A diagram showing how account data enters, moves through, and leaves an environment, including storage points and trust boundaries. Investigators use it to map where evidence and compromise indicators should be sought.

A documented, unbroken record of who collected, handled, transferred, and stored each item of evidence, and when. Gaps or inconsistencies can render evidence inadmissible or undermine investigative conclusions.

The property that collected evidence has not been altered since acquisition. It is demonstrated through cryptographic hashing, controlled handling, and documented procedures from collection through analysis and storage.

The principle of collecting the most perishable evidence first, such as CPU registers and memory, before disks and archival media. Following it prevents loss of transient artifacts like running processes and network connections.

A bit-for-bit copy of a storage device or memory space, created with a write-blocking method and verified by hash. Analysis is performed on the copy, preserving the original as evidence.

A hardware or software control that prevents any write operation to a source device during acquisition. It protects original evidence from alteration and supports the defensibility of the resulting image.

Comparing cryptographic digests, such as SHA-256, computed at acquisition and again before analysis to prove an image matches its source and remains unchanged. Documented hash values are a core evidentiary safeguard.

Acquiring a copy of volatile system memory for analysis of running processes, network connections, injected code, and encryption keys. It must occur early because memory contents disappear on shutdown or reboot.

Collecting volatile and other evidence from a running system, including processes, network state, logged-on users, and selected files. It balances evidence preservation against the operational need to keep systems running.

Correlating file system, log, and registry timestamps to reconstruct the sequence of attacker and system activity. Accurate time normalization across time zones and clock drift is essential to reliable conclusions.

Building a defensible narrative of how an attacker entered, moved laterally, escalated privileges, and exfiltrated data. It links individual artifacts into a coherent sequence supported by corroborating evidence.

Observable artifacts suggesting intrusion, such as malicious file hashes, command-and-control domains, registry keys, or unusual account activity. They guide scoping and are stronger when corroborated across multiple sources.

Techniques an attacker uses to move from one compromised host to others, such as remote desktop, SMB, PsExec, or stolen credentials. Tracking it defines how far compromise spread within the environment.

Gaining higher-level permissions than initially granted, through exploit, misconfiguration, or credential theft. It often marks the transition from limited foothold to administrative control over cardholder systems.

Mechanisms that let malicious code survive reboots or logoffs, such as scheduled tasks, services, registry run keys, or bootkit components. Finding every persistence mechanism is necessary to confirm eradication.

Malware or tooling that conceals its presence by modifying the operating system kernel or user-mode libraries. Detection may require memory analysis or offline examination rather than trusting the live system's own reporting.

Extracting password hashes, tickets, or plaintext credentials from memory or system stores, for example from LSASS. Stolen credentials enable lateral movement and make malicious activity resemble legitimate administration.

Malicious software that targets payment terminals or POS applications to capture card data, often through memory scraping or keystroke logging. Its presence in the CDE is a direct cardholder data compromise.

Malware that reads process memory to harvest unencrypted card data during authorization, leaving few traces on disk. Detection relies on memory forensics, process anomaly review, and behavioral indicators.

Unauthorized capture of card data at the point of transaction, whether through physical overlays on terminals or malicious software. It is a common objective in retail and hospitality breaches.

Unauthorized transfer of data out of an environment, often over encrypted channels, DNS, or cloud storage. Proving what left, when, and in what volume is central to a forensic report's impact assessment.

Infrastructure and protocols attackers use to communicate with compromised systems and direct activity. C2 traffic patterns in proxy, DNS, and firewall logs help determine the intrusion window and scope.

Combining and comparing records from multiple sources, such as firewalls, servers, applications, and identity systems, to identify related events. Correlation reveals patterns that individual logs cannot show.

Examining operating system, application, and security logs for authentication, privilege, service, and process events. Analysts look for anomalies such as impossible logons, cleared logs, and unusual service installs.

The period for which log history is preserved and available for review, typically set by PCI DSS to support investigations. Short retention frequently limits how far back a compromise can be reconstructed.

Examining firewall and router configurations to confirm that only required traffic reaches the CDE and that segmentation holds. Overly permissive rules are a common cause of expanded scope and attacker access.

An organization's preparation to support investigation, including adequate logging, time synchronization, retained evidence, and documented procedures. Weak readiness often determines the limits of what an investigation can prove.

A documented set of roles, procedures, and communication paths for detecting, containing, eradicating, and recovering from security incidents. It should be tested and should define when a forensic investigator is engaged.

Actions taken to stop the spread of a compromise while preserving evidence, such as isolating hosts or blocking traffic. Premature or destructive containment can destroy artifacts needed to determine scope.

Removing the cause of an incident, including malware, malicious accounts, and exploited vulnerabilities, and confirming removal through evidence. It precedes recovery and must address every persistence mechanism found.

A qualified assessor engaged to investigate suspected cardholder data compromise at payment brands' request and produce a report following required methodology. The role is distinct from a routine PCI DSS assessment.