# pci-dss-scoping

Walks an agent through PCI DSS scoping: cardholder data flows, segmentation checks and a v4.0 requirements matrix. Built for audit prep.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 414 installs
- Author: securityskills
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/securityskills/skills/tree/HEAD/compliance/pci-dss/pci-dss-scoping/SKILL.md
- Updated: 2026-08-26
- HTML: https://affpapa.org/en/nevibecode/skills/pci-dss-scoping

## What it does

The skill runs through five steps. First it traces the payment path end to end — capture, transmission, processing, storage, destruction — and hunts for PAN in databases, logs, backups, ticket systems and dev environments. Then it defines the CDE: every system that stores, processes or transmits cardholder data, plus connected services such as AD, DNS, NTP and monitoring.

Segmentation gets its own section. The skill asks you to document the controls and calls the segmentation penetration test mandatory under v4.0, verifying boundaries from out-of-scope zones in both directions. Skip segmentation and the whole network becomes the CDE, which usually costs more.

After that comes requirements mapping for v4.0: network controls, stored data protection, cryptography in transit, MFA for CDE access, logging, and targeted risk analysis for check frequencies. Output is data-flow diagrams, a scope document with in/out justification, a segmentation test plan and an evidence matrix. It prepares the paperwork — the assessor still signs off.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill pci-dss-scoping -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/pci-dss-scoping/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/pci-dss-scoping/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill pci-dss-scoping -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/pci-dss-scoping/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill pci-dss-scoping -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/pci-dss-scoping/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install securityskills/skills pci-dss-scoping
```

2. **Manually: put the files in place**
- File: `.github/skills/pci-dss-scoping/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill pci-dss-scoping -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/securityskills/skills --path compliance/pci-dss/pci-dss-scoping
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/pci-dss-scoping/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add securityskills/skills --skill pci-dss-scoping -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/securityskills/skills/tree/HEAD/compliance/pci-dss/pci-dss-scoping/SKILL.md

## When to use it
- trace PAN from capture to destruction
- find cardholder data hiding in logs and backups
- prove segmentation between the CDE and the rest of the network
- map PCI DSS v4.0 requirements to evidence
- assemble an evidence matrix for an assessment

## Example prompts
- Scope our payment service for PCI DSS: trace the cardholder data flows and define the CDE
- Check our segmentation — what do we need to prove to keep the dev zone out of scope?
- Build the v4.0 requirements and evidence matrix for our assessment

## Similar
- [pci-dss-compliance](https://affpapa.org/en/nevibecode/skills/pci-dss-compliance.md) — skill · 327 installs
- [pci-audit](https://affpapa.org/en/nevibecode/skills/pci-audit.md) — skill · 318 installs
- [compliance-tracking](https://affpapa.org/en/nevibecode/skills/compliance-tracking.md) — skill · 3000 installs
- [security-compliance-audit](https://affpapa.org/en/nevibecode/skills/security-compliance-audit.md) — skill · 665 installs
- [soc2-compliance](https://affpapa.org/en/nevibecode/skills/soc2-compliance.md) — skill · 658 installs
- [dd-audit-compliance-report](https://affpapa.org/en/nevibecode/skills/dd-audit-compliance-report.md) — skill · 477 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md