{"id":7768,"date":"2020-10-27T15:51:06","date_gmt":"2020-10-27T15:51:06","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/how-to-achieve-pci-compliance-in-the-public-cloud\/"},"modified":"2026-11-03T19:29:02","modified_gmt":"2026-11-03T19:29:02","slug":"how-to-achieve-pci-compliance-in-the-public-cloud","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/how-to-achieve-pci-compliance-in-the-public-cloud\/","title":{"rendered":"How to achieve PCI compliance in the public cloud"},"content":{"rendered":"<p><strong>Introduction<\/strong><\/p>\n<p>The Payment Card Industry Data Security Standard (PCI DSS) is a globally recognized&nbsp;regulation that protects consumer credit card information from theft and disclosure. It&nbsp;applies to all organizations that store, process, or transmit credit card&nbsp;information &#8211;even if it\u2019s just a few transactions each year.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>PCI compliance levels<\/strong><\/p>\n<p>Although PCI DSS applies to all businesses that accept or process payment cards, the&nbsp;requirements vary. For example, if your organization processes more than six million&nbsp;transactions a year, it must adhere to PCI Level 1 compliance modules. If it processes<br \/>\nfewer than 20,000, the requirements are less stringent.&nbsp;<\/p>\n<p>\nA merchant\u2019s PCI level depends on how many card transactions they handle each year:<\/p>\n<ul>\n<li><strong>PCI Level 4<\/strong>: Fewer than 20,000 annual transactions<\/li>\n<li><strong>PCI Level 3<\/strong>: 20,000 \u2013 1,000,000 annual transactions<\/li>\n<li><strong>PCI Level 2<\/strong>: 1,000,000 \u2013 6,000,000 annual transactions<\/li>\n<li><strong>PCI Level 1<\/strong>: 6,000,000+ annual transactions<\/li>\n<\/ul>\n<p><strong>&nbsp;PCI Level 1 compliance requirements<\/strong><\/p>\n<p>For PCI Level 1 compliance, you need to meet <a href=\"https:\/\/www.pcisecuritystandards.org\/pci_security\/maintaining_payment_security\">12 distinct modules<\/a>&nbsp;and address 200+ individual items within those modules.&nbsp;<\/p>\n<ol>\n<li>Building and maintaining a secure network and systems, including firewalls and server hardening<\/li>\n<li>Changing vendor-supplied default passwords and security parameters&nbsp;<\/li>\n<li>Network segmentation or segregation of PCI data from the rest of your environment<\/li>\n<li>Protecting cardholder data using encryption-at-rest<\/li>\n<li>Encrypting data during transmission across public networks&nbsp;<\/li>\n<li>Quarterly or annual vulnerability scans and regular monitoring and testing of networks<\/li>\n<li>Restricting user access to sensitive data and applications (using the principle of least privilege)&nbsp;<\/li>\n<li>Maintaining an Information Security Policy<\/li>\n<li>Controlling access through authentication and identity management<\/li>\n<li>Monitoring and tracking all network access to PCI data<\/li>\n<li>Regularly testing processes and security system&nbsp;<\/li>\n<li>Restricting physical access to PCI data<\/li>\n<\/ol>\n<p><strong>PCI assessors and solutions&nbsp;<\/strong><\/p>\n<p>Besides having internal staff certified to conduct PCI audits and network testing, you&nbsp;might need to reach out to a Qualified Security Assessor (QSA) or Approved Scanning Vendor&nbsp;(ASV) for additional assistance.<\/p>\n<p><strong>What is a QSA?<\/strong><\/p>\n<p>A QSA is a PCI-certified organization that can help you identify and meet compliance&nbsp;conditions. Your QSA performs the following tasks:&nbsp;<\/p>\n<ul>\n<li>Determine which modules you need to address<\/li>\n<li>Determine how stringent you need to be to meet the requirements<\/li>\n<li>Conduct audits and assess compliance over time&nbsp;<\/li>\n<\/ul>\n<p><strong>What is an ASV?<\/strong><\/p>\n<p>An ASV is an organization certified by the PCI council, through stringent testing of its&nbsp;own, to scan your perimeter and any cardholder assets. These include any internet-facing&nbsp;assets used to store, process, or transmit credit card information. Your ASV typically&nbsp;runs a quarterly or annual scan, but you can request more scans over time&#8211;such as&nbsp;when you\u2019re implementing remediation efforts or trying to correct compliance issues.&nbsp;<\/p>\n<p><strong>Consequences for PCI noncompliance<\/strong><\/p>\n<p>Achieving compliance is not just about ticking a box. The steps you take along the way can&nbsp;make your business more secure and less vulnerable to attackers. Noncompliance, on the&nbsp;other hand, can result in steep consequences, including the following:<\/p>\n<ul>\n<li><strong>Financial penalties<\/strong>: Credit card companies can charge merchants penalties ranging from $5,000 to $100,000 per month.<\/li>\n<li><strong>Costly breaches<\/strong>: The average cost of a data breach is&nbsp;<a href=\"https:\/\/www.ibm.com\/security\/data-breach\">$150 per record<\/a><\/li>\n<li><strong>Lost revenue<\/strong>: Breaches can bring your business to a standstill, leading to customer churn and lost revenue.&nbsp;<\/li>\n<li><strong>Damaged reputation<\/strong>: When customers lose trust in your abilities to&nbsp;<a href=\"https:\/\/www.rackspace.com\/solutions\/protect-my-data\">protect their personal data<\/a>&nbsp;or financial information, they often won\u2019t return.&nbsp;<\/li>\n<li><strong>Legal action<\/strong>: Data breach lawsuits are becoming an increasingly&nbsp;<a href=\"https:\/\/www.cyberinsecuritynews.com\/data-breach-litigation\">active and costly threat<\/a>.<\/li>\n<\/ul>\n<p><strong>PCI DSS compliance in the public cloud<\/strong><\/p>\n<p>Simply choosing a PCI-compliant public cloud platform doesn\u2019t automatically make your&nbsp;organization PCI-compliant. While your public cloud service provider (CSP) is responsible&nbsp;for the infrastructure and how the environment is used, you\u2019re responsible for your&nbsp;applications that store, process, or transmit payment card data. PCI compliance is a shared&nbsp;responsibility between you and your CSP.<\/p>\n<p>By working closely with your CSP, you can achieve&nbsp;<a href=\"https:\/\/www.rackspace.com\/compliance\/pci\">PCI-compliant hosting<\/a>&nbsp;on the public cloud by&nbsp;doing the following tasks:<\/p>\n<ul>\n<li>Create and maintain a cybersecurity strategy, including (<a href=\"https:\/\/www.rackspace.com\/security\/cloud-security-policy\">cloud security policy<\/a>) and control documents.<\/li>\n<li>Conduct penetration testing.<\/li>\n<li>Institute proactive threat detection and rapid remediation measures, including intelligence, monitoring, intrusion detection, and response.<\/li>\n<li>Design, build, manage, and secure solutions across your environments and platforms.<\/li>\n<li>Ensure all public cloud architecture components are PCI compliant across all your&nbsp;environments, including production, disaster recovery, development, and testing.<\/li>\n<li>Implement multi-layered security across global public cloud data centers.<\/li>\n<li>Use cloud-native services for networking, identity management, databases, and applications to protect sensitive data.<\/li>\n<li>Implement management and access controls, encryption, monitoring, firewalls, and&nbsp;environment and network segregation.<\/li>\n<\/ul>\n<p><strong>Maintain PCI compliance&nbsp;<\/strong><br \/>\nIt can be challenging to maintain PCI compliance as your organization, network, and<br \/>\ninfrastructure change &#8212; and as your business needs to evolve and grow. You must have a&nbsp;CSP that works with you and provides the&nbsp;<a href=\"https:\/\/www.rackspace.com\/security\">cloud security expertise<\/a>&nbsp;you need to answer your questions and solve problems.&nbsp;<\/p>\n<p><strong>Get started with PCI compliance on the public cloud<\/strong><\/p>\n<p>Let our [<a href=\"https:\/\/www.rackspace.com\/managed-security-services\/compliance-assistance\">multicloud security and compliance specialists<\/a>&nbsp;work with you to understand your challenges and goals and build a path to your desired&nbsp;outcomes. Our expertise across public clouds means you can address your PCI compliance&nbsp;needs more efficiently across <a href=\"https:\/\/www.rackspace.com\/managed-aws\">AWS\u00ae<\/a>,&nbsp;<a href=\"https:\/\/www.rackspace.com\/managed-google-cloud\">Google Cloud Platform\u00ae<\/a>&nbsp;and&nbsp;Microsoft\u00ae Azure\u00ae&nbsp;public clouds.<\/p>\n<p>Get started today.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to achieve PCI compliance in the public cloud<\/p>\n","protected":false},"author":2,"featured_media":7770,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26488","content_type":"blog","created_by":"10130","authored_on":"2024-01-14T16:51:06+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Rackspace's response to F5 BIG-IP security vulnerabilities. Recommended safe harbor code versions and upgrade instructions.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26488-insights_image-productivity-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"","product":"Rackspace Security Essentials","publisheddate":"2020-10-27T15:51:06","rxt_solutions":"Compliance & Governance","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"PCI Compliance in Public Cloud | Rackspace Technology","field_topics":"","field_slug":"how-to-achieve-pci-compliance-in-the-public-cloud","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7768","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7768"}],"version-history":[{"count":1,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7768\/revisions"}],"predecessor-version":[{"id":7769,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7768\/revisions\/7769"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7770"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}