Pages that map specific PCI DSS and GDPR obligations to the controls Magento Open Source documents, such as Content Security Policy, Subresource Integrity, admin two-factor authentication, cookie consent and patching.
Meeting the payment page script inventory, authorization and integrity rules and the tamper-detection rule with Magento's restrict-mode CSP and Subresource Integrity, plus the script inventory, justification records and weekly change detection they do not cover on their own.
Building a patch process that satisfies PCI DSS 6.3: tracking Adobe security bulletins and extension advisories, keeping an inventory of custom code and third-party components, ranking risk and installing critical fixes within 30 days.
Aligning Magento Admin accounts with PCI DSS requirement 8: two-factor authentication providers, password length and lockout settings, unique accounts per person, and multi-factor access to the servers and databases behind the store.
Handling GDPR duties on a self-hosted store: cookie consent with Cookie Restriction Mode, answering access and erasure requests using Adobe's personal data maps, order records you must keep, extension data flows and security of processing.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.