Best for: The PCI DSS standard applies to any organization, no matter what size, that accepts, transmits, or stores cardholder data. Its scope includes all systems, networks, and applications that process, store, or transmit cardholder data, and systems used to secure and log access to them.
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
The PCI Security Standards Council created the Payment Card Industry Data Security Standards. Visa, MasterCard, American Express, Discover and JCB established the Council as a separate organization to define practices that protect cardholder data.
What systems fall within the scope of PCI DSS?
The scope covers all systems, networks, and applications that process, store, or transmit cardholder data. It also covers systems that are used to secure and log access to the systems in scope.
Who is responsible for PCI DSS compliance of applications running on Google Cloud?
Google Cloud services provide an infrastructure on which customers may build services or applications that handle cardholder data. Customers are still responsible for ensuring that their applications are PCI DSS compliant.
How often is Google Cloud audited against PCI DSS, and where can reports be requested?
Google Cloud undergoes at least an annual third-party audit to certify individual products against the PCI DSS. PCI DSS reports may be requested via the Compliance Reports Manager for Google Cloud.
