PCI-DSS
The Payment Card Industry Data Security Standard governs systems that store, process, or transmit cardholder data. Gadriel Code targets the requirements that leave source evidence — primarily around secure development, cryptography, access, and logging.
Related: Compliance overview · SOC 2.
At a glance
| Property | Value |
|---|---|
| Slug | pci-dss |
| Aliases | pci |
| Controls | 12 |
| Manual-only | 2 |
| Machine-assessable | 10 |
| Direct mapping key | pci_dss |
Direct rule-to-control annotation for PCI-DSS is still thin. Expect PARTIAL verdicts for controls whose evidence isn't yet emitted by GVL — Gadriel now correctly reports "not yet evidenced" instead of silently PASSing.
Generating the report
bashgadriel code report --compliance pci-dss
Outputs: .security/compliance/pci-dss.{md,typ,pdf}.
What Gadriel evaluates
The scanner contributes evidence for requirements including:
- Req 3 — protect stored account data (encryption at rest, key handling, PAN masking in code paths).
- Req 4 — protect data in transit (TLS enforcement, disallowed cleartext).
- Req 6 — develop and maintain secure systems (OWASP-style vulnerabilities, dependency risk, SBOM).
- Req 8 — identify users and authenticate access.
- Req 10 — log and monitor.
Rules use compliance_mapping.pci_dss: Req_6.5.1 (etc.).
What PCI-DSS still requires from you
Cardholder data environment (CDE) scoping, network segmentation attestations, quarterly ASV scans, and penetration tests remain out of scope for a source scanner. Use Gadriel's report as one input into your PCI package.