Payment Security on Juan Carlos Munera

What the New PCI DSS to NIST CSF 2.0 Mapping Actually Buys You

Tue, 28 Jul 2026 00:00:00 +0000

What the new mapping actually buys you, where teams misread it as control equivalence, and how much rework that mistake creates.

The PCI DSS Comment Window Just Closed, and AI Was Named in the Ask

Tue, 21 Jul 2026 00:00:00 +0000

The Council named future technology and AI innovation in its request for comments. Here’s how the RFC process works and what happens next.

Magecart Moved Its C2 On-Chain. PCI DSS 6.4.3 and 11.6.1 Were Built for This

Mon, 20 Jul 2026 00:00:00 +0000

Blockchain C2 removes the domain you’d normally report. Why that pushes defense to exactly where PCI DSS 6.4.3 and 11.6.1 already point.

The AppsFlyer SDK Hijack: Why PCI DSS 6.4.3 and 11.6.1 Exist

Thu, 12 Mar 2026 00:00:00 +0000

If the AppsFlyer script loads on your payment pages, you may have been serving malicious code. What the requirements actually ask you to do.

AI in Payment Environments

Mon, 02 Mar 2026 00:00:00 +0000

PCI DSS v4.x wasn’t written with AI in mind. Here’s where the framework holds up, where there’s room to grow, and how the Council is engaging.

PCI SSC at 20: Breaking Down the Council's First-Ever Annual Report

Fri, 27 Feb 2026 00:00:00 +0000

Twenty years of standards, assessor programs, and a global ecosystem. What the Council’s inaugural annual report says about where it’s heading.

PCI DSS Toolkit

Thu, 26 Feb 2026 00:00:00 +0000

Read-only evidence collection for assessor review: FortiGate, Palo Alto, Cisco, Azure, AWS, and OS-level configuration exports.

Carding-as-a-Service: What Underground Dump Shops Mean for PCI Scope

Tue, 24 Feb 2026 00:00:00 +0000

Stolen card data is sold at industrial scale. What the carding economy means for your PCI DSS scoping, and why many programs frame it wrong.

File Integrity Monitoring for Docker & Kubernetes: A Complete PCI-DSS Guide

Fri, 13 Feb 2026 00:00:00 +0000

A complete guide to container FIM for PCI DSS: Docker, Kubernetes, Falco, and cloud-native patterns that survive ephemeral workloads.

File Integrity Monitoring for PCI-DSS: The Complete Multi-Cloud Guide

Tue, 10 Feb 2026 00:00:00 +0000

A complete multi-cloud walkthrough of file integrity monitoring for PCI DSS, from Linux agents to network device configs and cloud audit logs.

From Kickoff to Settlement: The Payment Card Ecosystem's Super Bowl

Mon, 09 Feb 2026 00:00:00 +0000

Authorization, clearing, settlement, and the security controls behind $20.2 billion in Super Bowl Sunday card transactions.

PCI DSS Periodic Compliance: Your Guide for Continuous Compliance

Wed, 04 Feb 2026 00:00:00 +0000

Staying PCI DSS compliant isn’t a one-time event, it’s an ongoing commitment with activities happening daily, weekly, monthly, quarterly, and annually. A newer category, introduced with v4.0 and carried forward in v4.0.1, covers activities whose frequency is set by the entity through a documented Targeted Risk Analysis (TRA) rather than fixed by the standard. Missing any of these periodic requirements can result in audit findings, remediation costs, and potential compliance failures.

Whether you’re a merchant managing your own compliance or working with a QSA, understanding the rhythm of PCI DSS is essential. This guide breaks down every periodic activity required by PCI DSS v4.0.1, organized by frequency (including TRA-defined activities) to help you build a sustainable compliance calendar.

PCI-DSS Compliance: Essential Best Practices for 2026

Thu, 22 Jan 2026 00:00:00 +0000

What keeps a PCI DSS program healthy under v4.0.1: scoping discipline, evidence hygiene, and controls that hold up at assessment time.