Overview
PCI DSS includes multiple requirements that directly reference configuration management, secure configuration, change control, and continuous monitoring. Configuration auditing provides the verification layer needed to satisfy these requirements.
Relevant PCI DSS Requirements
The following PCI DSS requirements relate most closely to configuration auditing:
- Requirement 2 – Secure configuration standards
- Requirement 6 – Change control and secure development
- Requirement 7 – Access control
- Requirement 8 – Authentication and identity management
- Requirement 10 – Logging and monitoring
- Requirement 11 – Vulnerability and configuration testing
- Requirement 12 – Policy and governance
Configuration auditing supports each of these requirements by verifying secure configuration settings and detecting unauthorized changes.
Configuration Auditing Mapping to PCI DSS Requirements
| PCI DSS Requirement | Description | How Configuration Auditing Supports It |
|---|---|---|
| Requirement 2 | Requires secure configuration standards and hardening. | Auditing verifies hardening settings and detects insecure configurations. |
| Requirement 6 | Requires controlled and documented changes. | Auditing detects unauthorized or undocumented configuration changes. |
| Requirement 7 | Requires proper access control. | Auditing verifies access configuration settings and permissions. |
| Requirement 8 | Requires secure authentication and identity management. | Auditing checks identity policies and authentication configuration. |
| Requirement 10 | Requires logging and monitoring. | Auditing produces logs, drift history, and configuration evidence. |
| Requirement 11 | Requires testing of security controls. | Auditing verifies configuration controls and detects drift. |
| Requirement 12 | Requires policy enforcement. | Auditing ensures systems remain aligned with configuration policies. |
Evidence for PCI DSS Compliance
Configuration auditing produces evidence required for PCI DSS audits, including:
- Configuration snapshots
- Drift history
- Change logs
- Access configuration reports
- Hardening verification
- Compliance reports
Evidence must be retained according to PCI DSS requirements and mapped to specific controls.
Conceptual Diagram
Hardening → Baseline → Continuous Checks → Drift Detection → Alerting → Remediation → Evidence Collection
Configuration auditing provides continuous verification across PCI DSS requirements.
PCI DSS Configuration Auditing Checklist
- Define secure configuration baselines
- Verify hardening settings
- Enable drift detection and alerts
- Monitor configuration changes
- Verify access and identity configuration
- Collect evidence for audits
- Automate remediation where possible
Frequently Asked Questions
How does configuration auditing support PCI DSS?
Configuration auditing supports PCI DSS by enforcing secure configuration standards, detecting drift, verifying hardening requirements, and producing evidence for audits.
Which PCI DSS requirements relate to configuration auditing?
Relevant requirements include 2, 6, 7, 8, 10, 11, and 12.
Is configuration auditing required for PCI DSS?
Yes. PCI DSS requires verification of secure configuration settings, change control, and continuous monitoring.