Day 12 of 22PCI DSS· ~75 min

Map PCI DSS 12 requirements to your controls

Scenario

Your QSA has asked you to produce a Requirement Coverage Matrix — showing that every PCI DSS v4.0 requirement is mapped to at least one implemented control at SwiftLend.

Your role

You are producing the coverage matrix for QSA review.

Your task

For each of the 12 PCI DSS v4.0 requirements, produce a row: - Requirement (number + name) - Your implementation (1-2 sentence description) - Evidence location (system / document / process) - Control owner (role, not person name) - Testing frequency - Gap or remediation-in-flight (be honest)

Deliverable format: Markdown table, 12 rows

Toolkit

PCI DSS v4.0 12 requirements (Req 1: firewall; Req 2: default configs; Req 3: stored CHD; Req 4: transmission; Req 5: malware; Req 6: secure dev; Req 7: access; Req 8: identity; Req 9: physical; Req 10: logging/monitoring; Req 11: testing; Req 12: policy)
For each 'evidence location' name a real system (Splunk index, GitHub repo, ticket queue)
Testing frequency: daily automated / weekly manual / quarterly / annual — be honest
Every row can honestly have a 'gap' — the QSA prefers honesty

Success criteria (what the AI grades against)

All 12 requirements listed correctly (correct numbers + names)
Every row has BOTH a control AND an evidence pointer
At least 3 rows show honest gaps (perfect coverage = QSA will disbelieve)
Requirement 3 (stored CHD) shows tokenisation strategy
Requirement 11 (testing) references both vulnerability scans AND pentests
Requirement 12 (policy) references dated policy docs