概述

PCI DSS合规检查器是一款安全评估工具，旨在评估组织是否满足支付卡行业数据安全标准（PCI DSS）要求。该API接受关于您的支付处理基础设施、安全控制措施和运营实践的详细信息，然后对所有12项PCI DSS要求进行全面的合规分析。

处理支付卡数据的组织——无论是通过电子商务平台、实体销售点系统、移动支付还是第三方处理商——都必须保持PCI DSS合规，以保护持卡人数据并避免监管处罚。该工具通过分析您在网络安全、访问控制、加密、漏洞管理和安全策略方面的安全态势，简化了自我评估流程。

合规检查器非常适合需要了解其PCI DSS合规状态、识别安全控制措施差距并优先安排补救措施的商户、支付处理商、服务提供商、安全团队和合规官。

使用方法

示例请求：

json
{
organization_name: TechRetail Inc.,
business_type: E-commerce Retailer,
company_size: Medium (50-500 employees),
transaction_volume: 1-5 million transactions/year,
card_brands: [Visa, Mastercard, American Express],
processing_methods: [Online, Mail Order/Telephone],
storescarddata: true,
transmitscarddata: true,
processescarddata: true,
ecommerce_website: true,
physicallocationspos: false,
mobile_payments: true,
thirdpartyprocessors: true,
cloud_services: true,
firewall_installed: true,
defaultpasswordschanged: true,
network_segmentation: true,
carddataprotected: true,
transmission_encrypted: true,
cryptographic_keys: true,
antivirus_installed: true,
securesystemsdevelopment: true,
vulnerability_management: true,
accesscontrolsby_role: true,
uniqueuserids: true,
multifactor_auth: true,
physicalaccessrestricted: true,
mediasecurelyhandled: true,
access_logged: true,
logsregularlyreviewed: true,
logintegrityprotected: true,
vulnerability_scans: true,
penetration_testing: true,
network_monitoring: true,
securitypolicymaintained: true,
securityawarenessprogram: true,
incidentresponseplan: true,
serviceprovidermonitoring: true
}

示例响应：

json
{
compliance_status: Compliant,
overall_score: 98,
assessment_date: 2025-01-20,
organization: TechRetail Inc.,
requirement_summary: {
requirement_1: {
name: Install and maintain firewall configuration,
status: Compliant,
score: 100
},
requirement_2: {
name: Do not use vendor-supplied defaults,
status: Compliant,
score: 100
},
requirement_3: {
name: Protect stored cardholder data,
status: Compliant,
score: 100
},
requirement_4: {
name: Encrypt transmission of cardholder data,
status: Compliant,
score: 100
},
requirement_5: {
name: Protect systems against malware,
status: Compliant,
score: 100
},
requirement_6: {
name: Develop and maintain secure systems,
status: Compliant,
score: 100
},
requirement_7: {
name: Implement strong access control measures,
status: Compliant,
score: 95
},
requirement_8: {
name: Identify users and restrict access,
status: Compliant,
score: 100
},
requirement_9: {
name: Restrict physical access to cardholder data,
status: Compliant,
score: 100
},
requirement_10: {
name: Track and monitor access to cardholder data,
status: Compliant,
score: 95
},
requirement_11: {
name: Test security systems regularly,
status: Compliant,
score: 100
},
requirement_12: {
name: Maintain information security policy,
status: Compliant,
score: 100
}
},
recommendations: [
Continue conducting regular vulnerability scans and penetration tests.,
Maintain robust service provider monitoring programs.,
Schedule quarterly access control audits to ensure least privilege is maintained.
],
next_steps: Schedule annual compliance validation assessment.
}

端点

POST /pci-compliance

描述： 根据组织的支付处理环境和安全控制措施执行PCI DSS合规评估。

方法： POST

路径： /pci-compliance

请求体：

该端点接受一个包含以下属性的JSON对象：