PCI DSS 4.0.1 in the cloud, requirement by requirement.
A CNAPP checks the settings it has policies for. Your assessor asks about all 249 requirements. NxSCORE shows how each one is met in your cloud, and what still needs a person to prove it.
You will recognise this if
- Your CNAPP’s PCI DSS score looks healthy, and the assessor’s request list is mostly things it never checks.
- Requirement 12 policies, key retirement records and code reviews sit in different folders, owned by different teams.
- The cardholder data environment spans AWS accounts, a database team and an identity provider.
- Evidence collected for the last assessment has quietly gone out of date.
What a CNAPP covers, and what it leaves.
The product team reviewed one widely used CNAPP’s AWS policies against every requirement in PCI DSS 4.0.1, and kept only the policies that really evidence it. Each requirement is counted once.
- A CNAPP policy counts towards it18
The CNAPP has a policy that tests what the requirement asks. NxSCORE checks it too, and counts each failing resource once.
- Only NxSCORE checks cover it91
A setting can be tested, but the CNAPP has no policy for it, or one that tests something else.
- Only evidence can show it140
Policies, reviews, records and systems outside the cloud. A person has to show it was done.
Every PCI DSS requirement also covers layers no cloud API can see: operating systems, databases, applications and the identity provider. So none is settled by checks alone.
Four requirements, and what each one takes.
For every requirement NxSCORE says how it can be met, and why checks are not enough where they are not.
| Requirement | Covered by | What it takes |
|---|---|---|
| 1.2.6 Insecure services, protocols and ports are mitigated | CNAPP policy and NxSCORE checks | Checks find insecure ports open on AWS; the documented risk and its mitigation, and systems outside AWS, need evidence. |
| 6.4.2 Web attacks on public-facing applications are detected and blocked | NxSCORE checks only | Checks show the web application firewall is attached and logging; evidence shows its rules are current. |
| 3.7.5 Keys are retired or replaced when needed | NxSCORE checks only | Checks show rotation is configured; records show weakened keys were actually retired. |
| 6.2.3 Bespoke software is reviewed for vulnerabilities before release | Evidence only | Code review or SAST records for releases, with what was found and fixed. |
Every requirement in one record. Now, proved once.
How NxSCORE keeps PCI DSS current.
The daily assessment settles what checks can settle. Your team and your analyst handle the rest, and the record shows who did what.
- 01
A status for every requirement, with the reason.
Each requirement shows how it is met, the checks behind it and whether each ran, the CNAPP policies that count towards it, and its failing resources, with a resource failing in both tools counted once.
Requirement statusSix states- Met
The checks pass, and any evidence it needs is accepted
- Met by compensating control
Met another way, reviewed by your analyst
- Failing
A check fails on at least one resource
- Evidence needed
No accepted evidence, or it has lapsed
- In review
Evidence waiting for your analyst
- Not assessed
The checks behind it could not run
- 02
Evidence prepared by your team, accepted by someone else.
Your team writes up the evidence and attaches the files. Your NxSCORE analyst accepts it, returns it with a reason, or rejects it, and whoever returned it cannot accept the resubmission. Accepted evidence counts to the end of the quarter, plus 30 days, and the daily assessment says when it falls due.
Evidence, one requirementCounted- PreparedYour team writes it up and attaches the files.
- ReviewedYour analyst accepts it, returns it with a reason, or rejects it.
- CountedTo the end of the quarter, plus 30 days.
- Due againThe daily assessment says when, and asks for it fresh.
- 03
Upload once, counted everywhere it applies.
One artifact often answers several frameworks. An approved information security policy counts for ISO 27001 A.5.1, PCI DSS 12.1.1 and NIST CSF GV.PO-01. Before accepting, the analyst sees every requirement the upload will meet.
NxSCORE keeps 4.0.1, and 4.0 and 3.2.1 for history. Evidence accepted for a requirement counts for the same requirement in the other versions.
Information security policy, approvedOne uploadRequirement Status ISO 27001 A.5.1 Met PCI DSS 12.1.1 Met NIST CSF GV.PO-01 Met - 04
The fixes that clear the most, first.
Every failing check behind a requirement is ranked by how many requirements it is the only failure in, and how many more it contributes to. The fix kit is written for your engineers to run; NxSCORE’s access stays read-only.
Fix these first, PCI DSS 4.0.1ExampleFailing check Alone holds back Contributes to CloudTrail log file validation off in 3 accounts Clears 9 14 Root account used in the last 90 days Clears 6 11 Security groups open to the internet on admin ports Clears 4 17 - 05
An evidence pack your assessor can read.
PCI DSS 4.0.1 downloads as one Excel workbook, laid out requirement by requirement with the evidence beside it. Its first sheet says plainly that it is not a report on compliance: that comes from your independent assessor or auditor.
Evidence pack, PCI DSS 4.0.1Excel, three sheetsSummary Requirements by status, as of the latest assessment Requirements Status, how each is met, failing resources, checks and CNAPP policies Evidence and compensating Status, when last accepted, when due again, and the files
Questions about PCI DSS in the cloud.
Can a CNAPP prove PCI DSS compliance on its own?
No. In the product team’s review of one widely used CNAPP, its AWS policies counted towards 18 of the 249 requirements in PCI DSS 4.0.1. Settings checks can count towards more, but every requirement also covers people, processes and systems outside the cloud, so evidence is always part of it.
Does NxSCORE issue a PCI DSS report on compliance?
No. Only a Qualified Security Assessor can. NxSCORE keeps the record the assessor works from: how each requirement is met, the checks and their results, and the evidence with who accepted it and when it falls due.
Which clouds does NxSCORE check for PCI DSS?
The requirement mapping was reviewed against AWS first, with Azure and Google Cloud checks added from open-source compliance mappings for those clouds. Requirements no check can see are met with evidence, whatever the cloud.
See how your cloud stands on PCI DSS 4.0.1.
Connect one cloud account in your cardholder data environment. After the first assessment, your analyst takes you through what is failing, what needs evidence, and which single fixes clear the most requirements.