PCI DSS v3.2.1

No. After March 31, 2024, all PCI DSS assessments must use v4.0 or later. A v3.2.1 Report on Compliance (ROC) or Self-Assessment Questionnaire (SAQ) completed before that date remains valid until its expiration (typically one year from the assessment date), but new assessments and renewals must use PCI DSS v4.0.1. The compliance.tf benchmark for v3.2.1 remains available for gap analysis and historical comparison; use the v4.0 benchmark for current compliance work.

Several changes are worth noting. Requirement 8.4.2 now mandates MFA for all access into the CDE, not just remote access. Requirement 6.4.2 introduces a web application firewall requirement for all public-facing web applications, removing the manual code review alternative. Requirement 12.3.1 requires a targeted risk analysis for each PCI DSS requirement where the organization uses flexibility. New Requirement 5.4 adds anti-phishing controls. Most of the controls mapped to v3.2.1 carry forward to v4.0 with minor renumbering, but additional controls will be needed for the new requirements.

No. These controls automate checks for a subset of PCI DSS requirements as they apply to AWS infrastructure. A full PCI DSS assessment covers physical security (Requirement 9), security policies and procedures (Requirement 12), personnel security awareness training (Requirement 12.6), and vendor management (Requirement 12.8), none of which can be verified through Terraform or cloud API checks. Use these controls to maintain continuous visibility into your AWS CDE posture between annual assessments, and pair them with manual evidence collection for non-technical requirements.

Start by identifying every AWS account, VPC, subnet, and service that stores, processes, or transmits cardholder data. Then identify all connected systems, meaning any resource that can communicate with CDE components, including shared services like Active Directory, DNS, logging pipelines, and CI/CD tooling. Network segmentation using separate VPCs or accounts with strict security group and NACL rules can reduce scope. AWS accounts with no network path to cardholder data that provide no security services to the CDE can be excluded. Document your scoping decisions; a QSA will validate them.

The mapped controls cover requirements that can be automatically verified through AWS configuration checks, concentrated in Requirements 1, 2, 3, 4, 6, and 10. Requirements with no automated AWS equivalent include Requirement 5 (anti-virus, which depends on OS-level agents), Requirement 7 (role-based access models that require business context), Requirement 8 (password policies that may live in identity providers outside AWS), Requirement 9 (physical security), Requirement 11 (penetration testing and IDS/IPS), and Requirement 12 (policies and procedures). Treat the automated benchmark as one input to your compliance program, not the complete picture.