PCI DSS 4.0 - Cryptographic Inventory and Post-Quantum Agility

Description

PQC-scoped view of PCI DSS 4.0: requirement 12.3.3 mandates a documented, periodically reviewed cryptographic cipher-suite inventory. PCI DSS sets no post-quantum deadline, so quantum-vulnerable cryptography is surfaced as advisory migration debt rather than a dated failure.

Rationale

PCI DSS 4.0 introduced explicit cryptographic-agility expectations (req. 12.3.3) without naming a PQC timeline. Modelling the inventory obligation as a hard control and the post-quantum exposure as advisory keeps the assessment faithful to what the standard actually requires.

Benefits

Payment-industry teams get an inventory-backed view of post-quantum exposure that aligns with PCI DSS 4.0’s cryptographic-agility direction without overstating a deadline the standard does not set.

Checkpoints

PCI DSS 4.0 — Cryptographic Inventory Maintained (Req. 12.3.3)

ID

pci_dss_4_pqc/crypto_inventory_established

Severity

high

Category

cryptography/post_quantum

Optional

false

Tags

crypto, inventory, pci-dss-4, pqc

Description

Checks that a cryptographic inventory (a CBOM) is maintained for the project, satisfying PCI DSS 4.0 requirement 12.3.3 (document and review cryptographic cipher suites and protocols in use).

Rationale

PCI DSS 4.0 req. 12.3.3 makes a documented, periodically reviewed cryptographic inventory a hard requirement — and it is the prerequisite for any post-quantum agility planning.

Verification

Xygeni passes the checkpoint when a non-empty cryptographic inventory is available — ingested from a CBOM supplied with --cbom or produced on demand by the crypto-asset detector — and fails when none was produced.

Remediation

Generate and maintain a cryptographic bill of materials covering the cipher suites and protocols in use, and review it periodically as required by PCI DSS 4.0 req. 12.3.3.

PCI DSS 4.0 — Quantum-Vulnerable Cryptography (Advisory)

ID

pci_dss_4_pqc/no_quantum_vulnerable_crypto

Severity

info

Category

cryptography/post_quantum

Optional

true

Tags

crypto, pci-dss-4, pqc, quantum

Description

Surfaces quantum-vulnerable (Shor-broken) public-key cryptography in the project’s inventory as advisory migration debt. PCI DSS 4.0 sets no post-quantum deadline, so this control never fails — it reports a partial result while such algorithms are present.

Rationale

PCI DSS 4.0’s cryptographic-agility requirement (12.3.3) anticipates algorithm change but states no PQC date. Reporting the exposure without a fabricated deadline keeps the assessment honest while still putting the migration on the radar.

Verification

Xygeni assembles the cryptographic inventory (from a CBOM supplied with --cbom or the crypto-asset detector), classifies quantum risk, and reports a partial result when Shor-broken algorithms are present; it passes when none are.

Remediation

Plan migration of quantum-vulnerable public-key algorithms to NIST post-quantum schemes (ML-KEM, ML-DSA, SLH-DSA) as part of PCI DSS cryptographic-agility, prioritising long-lived cardholder-data protection.