domains / families / security / pci-compliance

pci-compliance

combined

Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures. Review payment data flows and engineering control evidence for a scoped PCI assessment, without claiming certification.

When to use

Building payment processing systems
Handling credit card information
Implementing secure payment flows
Conducting PCI compliance audits
Reducing PCI compliance scope
Implementing tokenization and encryption
Preparing for PCI DSS assessments
Review payment data flows, prepare engineering controls or collect evidence for a scoped PCI assessment. This skill does not certify compliance or determine assessment eligibility on its own.

When not to use

The task is unrelated to pci compliance
You need a different domain or tool outside this scope
Encryption, hosted checkout or a passed scan alone does not prove compliance. This package includes no automated audit script, payment processor client or certified encryption utility. Use reviewed integration code and qualified assessment…

Skill page

Conflict

The two copies overlap on PCI DSS scope, data minimization, and tokenization, but they serve different purposes and contain material steps the other lacks. The first copy is an implementation guide with the 12 core requirements, compliance levels, and code examples for sanitization and tokenization. The second copy is an evidence-review procedure for a scoped assessment, emphasizing data-flow mapping, verification of actual integration behavior, and producing a control/evidence/gap table. They also disagree on the use of custom encryption: the first provides a 'Custom Tokenization' code snippet, while the second explicitly warns against building a custom card vault from an illustrative snippet. Crowning one would hide the other's distinct approach to either implementation or assessment evidence.