PCI CFA study plan
PCI CFA · Give each week a clear focus.
8 weeks · About 7 hours per week
PCI DSS Requirements and Scope
Map each of the 12 PCI DSS requirements to the specific evidence artifacts a PFI would collect for it (config exports, logs, policy excerpts)
Distinguish CDE, connected-to, and security-impacting system boundaries and write a one-line justification for each of 15 sample system types
Explain how scoping decisions change the number of systems in scope and list three common scope-reduction techniques (segmentation, tokenization, P2PE) with their evidentiary implications
Walk through the six PCI DSS goals and state which requirements belong to each
Your checkpoint
A one-page scope decision table listing 15 system types, their classification (CDE / connected-to / security-impacting / out of scope), and the evidence type that proves each classification
PCI DSS Requirements and Scope & Cardholder Data Environment Analysis and Compromise Assessment
Trace how cardholder data flows from point of interaction to storage and identify every storage location in a sample architecture
Apply the data-retention and secure-deletion requirements to determine whether stored PAN, SAD, or truncated PAN is permissible in three scenarios
Identify where PAN could appear unexpectedly (logs, error dumps, memory, backups, batch files) and describe how a forensic examiner would look for each
Explain segmentation testing requirements and what a failed segmentation test means for scope
Your checkpoint
A cardholder data flow diagram for a fictional three-location retailer with every storage point, retention period, and deletion mechanism annotated
Forensic Investigation Methodology and Evidence Handling
Describe the order of volatility and justify collection sequencing for a live compromised POS terminal
Write the chain-of-custody fields needed for evidence intake, transfer, and storage, and explain why each field matters in a PFI report
Compare imaging approaches (physical vs. logical, live vs. dead-box) and state when each is defensible
Explain how to preserve volatile data (memory, network connections, running processes) without altering timestamps or content
Identify the documentation an examiner must produce when evidence is unusable or corrupted
Your checkpoint
A completed chain-of-custody form and a written collection plan for a live POS terminal, including tool choices, hashing steps, and volatile-data capture order
Forensic Investigation Methodology and Evidence Handling & Malware Analysis and Attacker Tradecraft
Analyze a memory image for injected code, credential scrapers, and process hollowing indicators and explain each finding
Identify common POS malware behaviors (memory scraping, keylogging, RAM parsing of track data) and the artifacts each leaves behind
Explain how attackers establish persistence on Windows and Linux and where the corresponding forensic artifacts live
Describe how to correlate malware execution artifacts with network and log evidence to build an intrusion timeline
Your checkpoint
A written malware triage note for one sample: execution mechanism, persistence, data targeted, indicators of compromise, and the artifacts that support each conclusion
Malware Analysis and Attacker Tradecraft & Network and System Log Analysis
Reconstruct an attack timeline from Windows event logs, firewall logs, and proxy logs and state the confidence level of each inference
Explain what DNS, DHCP, and VPN logs contribute to attributing activity to a specific host or user
Identify log sources that are commonly missing in card environments and describe what that gap means for conclusions
Distinguish normal administrative activity from attacker tradecraft in a set of sample log excerpts
Explain log integrity concerns (time skew, retention, tampering) and how to document them
Your checkpoint
A reconstructed timeline covering initial access through data exfiltration for a synthetic log set, with each event tied to its source log and a confidence rating
Network and System Log Analysis & Incident Response and Containment
Define containment options in a card-data compromise and state the trade-off between stopping data loss and preserving evidence
Explain how to isolate a compromised host without destroying volatile evidence
Describe eradication steps and how to verify that malware has been removed before restoring systems
Identify the notification and escalation paths a PFI must respect during an active incident
Explain how to coordinate with the acquirer, card brands, and law enforcement without compromising the investigation
Your checkpoint
A containment and eradication runbook for a POS compromise scenario, listing ordered actions, evidence-preservation checkpoints, and decision owners
Reporting, Documentation, and PCI Forensic Investigator (PFI) Procedures & Cardholder Data Environment Analysis and Compromise Assessment
Structure a PFI report: scope, methodology, findings, evidence index, and conclusions, and state what belongs in each section
Write findings that separate confirmed fact from inference and state the evidence supporting each conclusion
Explain how to document scope limitations and their effect on conclusions
Assess a compromise scenario for the root cause and the control failures that allowed it, and tie each failure to a PCI DSS requirement
Your checkpoint
A full draft PFI-style report (8-12 pages) for one synthetic case, including evidence index and requirement-mapped root-cause findings
PCI DSS Requirements and Scope & Forensic Investigation Methodology and Evidence Handling & Cardholder Data Environment Analysis and Compromise Assessment & Malware Analysis and Attacker Tradecraft & Network and System Log Analysis & Reporting, Documentation, and PCI Forensic Investigator (PFI) Procedures & Incident Response and Containment
Review weak areas identified in weeks 1-7 and close at least three specific knowledge gaps
Practice explaining scope, evidence handling, and reporting decisions aloud in under two minutes each
Re-derive the order of volatility, chain-of-custody fields, and report structure from memory
Complete a timed mixed-domain practice set and analyze every missed question by domain
Your checkpoint
A one-page personal review sheet of weak areas with corrected answers, plus a timed practice score broken down by domain
Milestones
Week 2: Can classify any system as CDE, connected-to, security-impacting, or out of scope and justify it with the evidence that proves the classification
Week 4: Can produce a defensible evidence collection plan and a chain-of-custody record for a live compromised host without prompting
Week 6: Can reconstruct an attack timeline from mixed log sources and state a confidence level for each event
Week 8: Can draft a complete PFI-style report from a scenario and score at or above target on a timed mixed-domain practice set