AI Rules for PCI-DSS Compliance

PCI-DSS: 12 Requirements for Payment Security

PCI-DSS (Payment Card Industry Data Security Standard) v4.0 defines 12 requirements organized into 6 goals: Build and Maintain a Secure Network (Requirements 1-2), Protect Cardholder Data (3-4), Maintain a Vulnerability Management Program (5-6), Implement Strong Access Control (7-9), Regularly Monitor and Test Networks (10-11), and Maintain an Information Security Policy (12). Every system that stores, processes, or transmits cardholder data must comply.

PCI scope: the most important concept for AI rules. Every system, component, and process that touches cardholder data (or could affect its security) is in PCI scope and must comply with all 12 requirements. The AI governance strategy: minimize PCI scope. Use tokenization (Stripe, Braintree, Adyen handle the card data; your system handles only tokens). AI rule: 'The primary AI rule for PCI: do not handle raw cardholder data. Use a PCI-compliant payment processor. If your system never sees card numbers: your PCI scope is minimal (SAQ A).'

When you must handle cardholder data: some applications (payment processors, card issuers, POS systems) must handle raw card data. These systems require full PCI-DSS compliance (SAQ D), which is significantly more rigorous. AI rule: 'If the application must handle cardholder data: every AI-generated feature is subject to PCI requirements. The AI must implement all applicable controls from all 12 requirements. This is the most compliance-heavy environment for code generation.'

Protecting Cardholder Data (Requirements 3-4)

Requirement 3 — Protect stored cardholder data: primary account number (PAN) must be rendered unreadable anywhere it is stored (encryption, hashing, truncation, or tokenization). CVV/CVC must never be stored after authorization (not even encrypted). Cardholder data retention must be minimized. AI rule: 'PAN storage: if absolutely necessary, encrypt with AES-256 and manage keys per PCI key management requirements. CVV: never store, never log, never cache. Retention: define a minimum retention period and auto-delete after expiration.'

Requirement 4 — Encrypt transmission of cardholder data: all cardholder data transmitted across open networks must be encrypted with strong cryptography. AI rule: 'TLS 1.2+ for all cardholder data transmission. No cardholder data in URL parameters (logged by web servers and proxies). No cardholder data in cookies. No cardholder data in client-side storage (localStorage, sessionStorage). The AI must never generate code that places card numbers in URLs, cookies, or browser storage.'

The tokenization strategy: instead of storing card numbers, store a token that references the card at the payment processor. Stripe: tok_xxxxx references the card without exposing the number. AI rule: 'Always use tokenization. Client-side: use the payment processor's SDK (Stripe Elements, Adyen Drop-in) to collect card data. The card number never touches your server. Server-side: store the token, not the card number. This reduces PCI scope from SAQ D to SAQ A.'

⚠️ CVV Must Never Be Stored — Not Even Encrypted

PCI-DSS Requirement 3.2 is absolute: after authorization, the card verification value (CVV/CVC) must not be stored under any circumstances. Not encrypted, not hashed, not in logs, not in backups, not temporarily. The purpose of CVV is to prove the cardholder has the physical card at the time of the transaction. Storing it defeats that purpose and is a PCI violation regardless of how securely it is stored.

Access Controls and Logging (Requirements 7-10)

Requirement 7 — Restrict access to cardholder data by business need-to-know: only personnel whose job requires access to cardholder data should have it. AI rule: 'Role-based access control: define roles that need cardholder data access (payment processing team, fraud analysts). Default: no access. Access requires explicit role assignment. The AI should generate RBAC that denies cardholder data access by default.'

Requirement 8 — Identify and authenticate access: unique ID for every user, MFA for administrative access, strong password requirements. AI rule: 'No shared accounts in PCI scope systems. MFA required for all access to cardholder data environments. Password: minimum 12 characters (PCI v4.0), complexity requirements, 90-day rotation for service accounts. The AI must generate authentication that meets PCI v4.0 password requirements.'

Requirement 10 — Log and monitor all access: all access to network resources and cardholder data must be logged. Logs must include: user ID, event type, date/time, success/failure, origination, and identity of affected data. AI rule: 'Every access to cardholder data: logged with who, what, when, where, and outcome. Logs: immutable, retained for 12 months (3 months immediately available). Daily log reviews automated with alerts for: failed authentication, privilege escalation, access outside business hours.'

💡 SAQ A vs SAQ D: The Scope Difference Is Enormous

SAQ A (tokenized, card data never touches your server): 22 requirements, self-assessment, minimal audit effort. SAQ D (you handle raw cardholder data): 300+ requirements, on-site audit by QSA, network penetration testing, quarterly ASV scans, detailed documentation. The effort difference is 10-50x. The AI rule is clear: use tokenization to achieve SAQ A unless the business absolutely requires handling raw card data.

Network Security and Testing (Requirements 1-2, 5-6, 11)

Requirements 1-2 — Network security: install and maintain network security controls (firewalls, segmentation). Segment the cardholder data environment (CDE) from the rest of the network. AI rule: 'The CDE must be network-segmented from non-PCI systems. The AI generating infrastructure code: define firewall rules that restrict traffic to/from the CDE. Only necessary ports and protocols. Default deny all inbound to the CDE. Document every allowed connection.'

Requirements 5-6 — Vulnerability management: protect systems against malware, develop and maintain secure systems. Requirement 6.2: custom software must be developed based on secure coding guidelines (OWASP Top 10). AI rule: 'Every AI-generated feature in PCI scope: review against OWASP Top 10 (injection, broken authentication, XSS, insecure deserialization, etc.). Generate input validation, output encoding, parameterized queries, and CSRF protection by default. PCI v4.0 requires automated technical solutions to detect and prevent web-based attacks.'

Requirement 11 — Regular testing: vulnerability scans (quarterly by ASV for external, quarterly internal), penetration testing (annually external and internal), and intrusion detection. AI rule: 'Generate security testing configurations alongside application code. Include: dependency vulnerability scanning in CI/CD, SAST (static analysis) for common vulnerabilities, and API security testing for cardholder data endpoints. The AI should generate test cases that verify PCI controls (authentication enforcement, encryption verification, access control testing).'

ℹ️ PCI v4.0 Requires Automated Web Attack Detection

PCI-DSS v4.0 Requirement 6.4.2 requires automated technical solutions (WAF or equivalent) to detect and prevent web-based attacks on public-facing web applications. This is a new mandatory requirement (previously addressable). The AI should generate: input validation on all endpoints, output encoding to prevent XSS, parameterized queries for SQL, and integration points for WAF configuration. Automated protection is no longer optional.

PCI-DSS AI Rules Summary

Summary of AI rules mapped to PCI-DSS v4.0 requirements for payment-handling code.

Scope reduction: use tokenization (Stripe/Adyen/Braintree). Never handle raw card numbers if possible
PAN storage: AES-256 if required. CVV: never store (not even encrypted). Minimize retention
Transmission: TLS 1.2+. No card data in URLs, cookies, or client-side storage
Access control: RBAC, deny by default. Only business need-to-know gets cardholder data access
Authentication: unique IDs, no shared accounts, MFA for CDE access, 12-char passwords (v4.0)
Logging: every cardholder data access logged. 12-month retention. Daily automated review
Network: CDE segmented, firewall rules documented, default deny inbound
Testing: OWASP Top 10 review, quarterly vulnerability scans, annual penetration testing