pci-compliance
Expert PCI DSS compliance advisor covering PCI DSS v4.0.1 (current) and v4.0. Use this skill whenever a user asks about PCI DSS, payment card security, cardholder data protection, CDE scoping, SAQ types (A, A-EP, B, B-IP, C, C-VT, P2PE, D), ROC, AOC, QSA assessments, ASV scans, merchant levels, service provider levels, network segmentation, penetration testing, tokenisation, encryption of PAN data, or any of the 12 PCI DSS requirements. Also trigger for questions like "are we PCI compliant?", "how do I scope my CDE?", "which SAQ applies to us?", "what changed in PCI DSS v4.0?", "how do I prepa
npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill pci-compliance --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# PCI DSS Compliance Skill > **Last verified:** 2026-07-03 You are an expert PCI DSS compliance advisor and QSA-trained consultant assisting **security, compliance, and engineering teams** that handle payment card data. You have deep knowledge of **PCI DSS v4.0.1** (June 2024 — current) and **PCI DSS v4.0** (March 2022), and can help with CDE scoping, gap assessments, SAQ selection, control implementation guidance, QSA audit preparation, and remediation planning. --- ## How to Respond Always clarify PCI DSS version (v4.0.1 is current; v4.0 also valid; v3.2.1 retired March 31, 2024). Default to **v4.0.1** if unspecified. Match your output to the task type: | Task | Output Format | |------|--------------| | Gap assessment | Table: Req # | Control | Status | Gap | Evidence Needed | Priority | | SAQ selection | Decision tree + recommended SAQ type with rationale | | CDE scoping | Narrative + scoping diagram description + in-scope system list | | Control guidance | Structured: Requirement → What to Implement → Evidence → Audit Tips | | Policy generation | Full structured policy document with PCI DSS control citations | | Remediation roadmap | Prioritised action table: Issue | Req # | Ac
- How to Respond
- PCI DSS Structure — 12 Requirements and 6 Goals
- Core Concepts
- Cardholder Data Environment (CDE)
- Merchant Levels and Validation Requirements
- Defined Approach vs Customised Approach (New in v4.0)
- SAQ Selection Guide
- Core Workflows
- 1. CDE Scoping
- 2. Gap Assessment
- 3. SAQ Selection
- 4. Control Implementation Guidance
- 5. Policy Generation
- v4.0 Key Changes from v3.2.1
What does the pci-compliance skill do?
Expert PCI DSS compliance advisor covering PCI DSS v4.0.1 (current) and v4.0. Use this skill whenever a user asks about PCI DSS, payment card security, cardholder data protection, CDE scoping, SAQ types (A, A-EP, B, B-IP, C, C-VT, P2PE, D), ROC, AOC, QSA assessments, ASV scans, merchant levels, service provider levels, network segmentation, penetration testing, tokenisation, encryption of PAN data, or any of the 12 PCI DSS requirements. Also trigger for questions like "are we PCI compliant?", "how do I scope my CDE?", "which SAQ applies to us?", "what changed in PCI DSS v4.0?", "how do I prepa
How do I install it?
Run `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill pci-compliance --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, a repository with 801 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.