The infrastructure side of PCI DSS: open-source tools that meet technical requirements, file integrity monitoring, containers and Kubernetes, and building cardholder data environments on AWS or Azure.
Which open-source tools cover PCI DSS technical requirements (log monitoring, file integrity, internal vulnerability scanning, MFA, key management, time sync, network controls, web attack protection), their licenses, and where an ASV or other listed provider is still required.
Where PCI DSS requires change detection: audit log protection under 10.3.4, weekly critical file comparisons under 11.5.2, payment page tamper detection, control failure alerts, and open-source tools that provide file integrity monitoring.
Running cardholder data workloads on containers and Kubernetes: the SSC's container guidance, inventories of ephemeral systems, configuration standards and infrastructure as code, image and cluster scanning, admission policies and runtime detection.
Building a cardholder data environment on AWS: AWS's Level 1 service provider validation, getting the AOC and Responsibility Summary from AWS Artifact, what your QSA can rely on, in-scope services and what remains your responsibility.
Building a cardholder data environment on Azure: Microsoft's PCI DSS v4.0 Level 1 validation, the AOCs and Shared Responsibility Matrix on the Service Trust Portal, services covered, Azure Policy mappings and the controls you still own.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.