https://www.syncyourcloud.io/static/js/7785.c61c9622.chunk.js

1"use strict";(self.webpackChunkweb_tools=self.webpackChunkweb_tools||[]).push([[7785],{53803(e,n,i){i.r(n),i.d(n,{default:()=>l});i(9950);var t=i(20030),s=i(28429),o=i(39524),r=i(73881),a=i(49757),c=i(67722),d=i(44414);const l=()=>{const e=(0,s.Zp)();return(0,d.jsxs)(c.YW,{children:[(0,d.jsx)(o.A,{title:"Payment Failure Runbook: What a QSA Expects to See (PCI DSS 4.0.1)",description:"The PCI DSS sub-requirements a payment failure runbook satisfies, what QSAs check during evidence review, and the operational gaps that appear when runbooks are written for engineers rather than auditors.",keywords:"payment failure runbook pci dss, incident response runbook pci, pci dss incident response requirements, payment system runbook qsa, pci dss 12.10 incident response, aws payment failure runbook",canonical:"https://www.syncyourcloud.io/insights/payment-failure-runbook-pci-dss-qsa"}),(0,d.jsxs)(c.lq,{children:[(0,d.jsxs)(c.Qp,{children:[(0,d.jsx)("span",{onClick:()=>e("/"),children:"Home"}),(0,d.jsx)("span",{className:"sep",children:"/"}),(0,d.jsx)("span",{onClick:()=>e("/insights"),children:"Insights"}),(0,d.jsx)("span",{className:"sep",children:"/"}),(0,d.jsx)("span",{className:"current",children:"Payment Failure Runbook: QSA Expectations"})]}),(0,d.jsx)(c.vw,{children:"PCI DSS 4.0.1 \xb7 Incident Response"}),(0,d.jsx)(c.H1,{children:"Payment Failure Runbook: What a QSA Expects to See"}),(0,d.jsx)(c.Zw,{children:"A payment failure runbook is written for engineers who need to restore service at 2am. A QSA reads it differently \u2014 looking for evidence that incident response procedures exist, are tested, and satisfy the specific sub-requirements of PCI DSS Requirement 12.10. Most runbooks satisfy neither purpose fully. This article shows what needs to change."}),(0,d.jsxs)(c.W8,{children:[(0,d.jsxs)("span",{children:[(0,d.jsx)(t.g,{icon:"clock"})," 13 min read"]}),(0,d.jsxs)("span",{children:[(0,d.jsx)(t.g,{icon:"shield-halved"})," PCI DSS 4.0.1"]}),(0,d.jsxs)("span",{children:[(0,d.jsx)(t.g,{icon:"file-lines"})," Incident Response"]})]})]}),(0,d.jsxs)(c.nB,{children:[(0,d.jsx)(c.H2,{children:"Why Payment Runbooks and PCI DSS Diverge"}),(0,d.jsx)(c.P,{children:"Engineering teams write runbooks to solve operational problems: a payment processor is returning 5xx errors, a Lambda timeout is causing transaction failures, a database connection pool is exhausted. The runbook documents the diagnostic steps and the fix. The audience is the on-call engineer."}),(0,d.jsx)(c.P,{children:"PCI DSS Requirement 12.10 addresses incident response from a different angle: it requires evidence that the organisation can detect, contain, investigate, and recover from security incidents affecting cardholder data \u2014 and that these capabilities are documented, assigned, and tested. A payment failure is potentially a security incident. A runbook that treats it only as an operational event fails the compliance requirement."}),(0,d.jsx)(c.Pq,{children:(0,d.jsxs)("p",{children:[(0,d.jsx)("strong",{children:"The distinction that matters:"}),' An operational runbook asks "how do we restore service?" A PCI DSS-compliant incident response procedure asks "was cardholder data exposed during this failure, and what do we do if it was?" Most runbooks answer the first question. Very few answer the second.']})}),(0,d.jsx)(c.H2,{children:"PCI DSS Requirements a Runbook Must Satisfy"}),(0,d.jsx)(c.Du,{children:(0,d.jsxs)(c.XI,{children:[(0,d.jsx)("thead",{children:(0,d.jsxs)("tr",{children:[(0,d.jsx)("th",{children:"Sub-req"}),(0,d.jsx)("th",{children:"Requirement"}),(0,d.jsx)("th",{children:"What the runbook must contain"}),(0,d.jsx)("th",{children:"QSA verification method"})]})}),(0,d.jsx)("tbody",{children:[["12.10.1","Written incident response plan covering all system components","Named roles and responsibilities for payment failure scenarios; escalation path to CISO/DPO; acquirer notification procedure","Review: role names match current org chart; notification contacts are current; plan version is dated within 12 months"],["12.10.2","Incident response plan reviewed and tested at least annually","Evidence of tabletop exercise or simulated payment failure scenario within 12 months; test outcome documented","Review: test date confirmed; participants named; gaps identified in test documented with remediation status"],["12.10.3","Specific personnel available 24/7 to respond to suspected security breaches","On-call rota or escalation matrix showing coverage for payment failure/breach scenarios; contact details current","Review: on-call schedule covers 24/7; contacts verified as current employees with correct roles"],["12.10.4","Personnel trained on incident response procedures","Training completion evidence for all personnel named in the runbook; training dated within 12 months","Review: training records match personnel list in runbook; content covers payment breach scenarios"],["12.10.5","Monitoring and alerting for all critical system components in CDE","CloudWatch alarms or SIEM alerts referenced in runbook; alert thresholds documented; alert-to-runbook linkage confirmed","Review: alert names in runbook match deployed alarms; thresholds are quantified not qualitative"],["12.10.7 \u2605","Incident response procedures for suspected PAN exposure","Explicit procedure for suspected/confirmed CHD exposure: contain, preserve evidence, notify acquirer, engage PFI if required","Review: CHD exposure scenario is a named scenario in the runbook, not implied; PFI contact is listed"]].map(e=>{let[n,i,t,s]=e;return(0,d.jsxs)("tr",{children:[(0,d.jsx)("td",{className:"grn",children:n}),(0,d.jsx)("td",{children:(0,d.jsx)(c.OH,{children:i})}),(0,d.jsx)("td",{className:"dim",children:t}),(0,d.jsx)("td",{children:s})]},n)})})]})}),(0,d.jsx)(c.P,{style:{fontSize:"0.8rem",color:"#475569"},children:"\u2605 New or materially changed in PCI DSS 4.0.1"}),(0,d.jsx)(c.H2,{children:"The Anatomy of a QSA-Ready Payment Failure Runbook"}),(0,d.jsx)(c.P,{children:"A runbook that satisfies both operational and compliance requirements has a specific structure. The following sections are required \u2014 sections that are standard in engineering runbooks are noted, sections that are compliance-specific are marked."}),(0,d.jsx)(c.bw,{children:[{num:"01",title:"Incident classification matrix [Compliance-specific]",desc:"Before any diagnostic step, the runbook must classify the incident. Payment failures fall into at least three categories: (1) operational failure \u2014 service unavailable, no CHD exposure; (2) suspected security incident \u2014 anomalous behaviour that may indicate CHD exposure; (3) confirmed breach \u2014 CHD confirmed as exposed. The classification determines the response path. Most runbooks have only one path \u2014 the operational path."},{num:"02",title:"Immediate containment steps [Compliance-specific]",desc:"If the failure is classified as a suspected security incident, the runbook must specify containment actions before diagnosis. 

1Containment typically means: isolate affected Lambda functions or EC2 instances from the CDE network, revoke active IAM sessions, preserve CloudTrail logs and VPC Flow Logs for forensic use, and suspend automated scaling that could spin up new compromised instances. These steps are distinct from \u2014 and must precede \u2014 service restoration."},{num:"03",title:"Evidence preservation checklist [Compliance-specific]",desc:"PCI DSS and acquirer contracts require forensic investigation of suspected breaches. Investigation requires logs. The runbook must include a checklist of evidence to preserve before any remediation action that could destroy it: CloudTrail log export to immutable S3, VPC Flow Log archive, application log preservation, Lambda function version snapshot, RDS point-in-time snapshot. Remediation steps that follow must note which evidence-preservation steps must precede them."},{num:"04",title:"Diagnostic procedures [Standard engineering content]",desc:"The standard engineering runbook content: check AWS Service Health Dashboard, review CloudWatch metrics for the payment processor integration, inspect Lambda error logs, verify RDS connection pool, check downstream API response codes. This section is usually well-written in engineering runbooks \u2014 the compliance gaps are elsewhere."},{num:"05",title:"Escalation and notification matrix [Compliance-specific]",desc:'The runbook must specify: who is notified at each classification level, within what timeframe, and with what information. For a suspected breach: CISO within 1 hour, DPO within 4 hours (GDPR obligation), acquirer within 24 hours (acquirer contract obligation), card brands within 24 hours of confirmed or suspected CHD exposure (Visa CDRP / Mastercard ADCR obligations). Contact details \u2014 names, direct lines, email addresses \u2014 must be current. A runbook that lists "CISO" without a name or contact is not compliant.'},{num:"06",title:"Remediation and recovery steps [Standard engineering content]",de

1sc:"Service restoration steps. These are standard engineering runbook content. The compliance requirement here is that remediation steps do not destroy forensic evidence \u2014 covered by the evidence preservation checklist. Additionally, the runbook should note that service restoration does not close the incident \u2014 the incident remains open until root cause is confirmed and breach determination is made."},{num:"07",title:"Post-incident review procedure [Compliance-specific]",desc:"Req 12.10.6 requires the incident response plan to be updated following any security incident. The runbook must specify: when the post-incident review occurs (within 72 hours), who attends, what outputs are required (timeline, root cause, control gap identification, runbook update), and how updates are approved and versioned. Without this, the runbook itself becomes stale evidence."}].map(e=>(0,d.jsxs)(c.pn,{children:[(0,d.jsx)(c.Tx,{children:e.num}),(0,d.jsxs)(c.Nf,{children:[(0,d.jsx)(c.JR,{children:e.title}),(0,d.jsx)(c.KN,{children:e.desc})]})]},e.num))}),(0,d.jsx)(c.H2,{children:"AWS-Specific Evidence Requirements During a Payment Incident"}),(0,d.jsx)(c.P,{children:"When a payment failure escalates to a suspected breach, a PFI (PCI Forensic Investigator) will request the following AWS evidence. The runbook should specify how each is preserved:"}),(0,d.jsx)(c.Du,{children:(0,d.jsxs)(c.XI,{children:[(0,d.jsx)("thead",{children:(0,d.jsxs)("tr",{children:[(0,d.jsx)("th",{children:"Evidence type"}),(0,d.jsx)("th",{children:"AWS source"}),(0,d.jsx)("th",{children:"Preservation action"}),(0,d.jsx)("th",{children:"Retention required"})]})}),(0,d.jsx)("tbody",{children:[["API call history","CloudTrail (management + data events)","Copy trail to immutable S3 with Object Lock; disable log rotation for incident period","12 months minimum; 3 months immediately accessible"],["Network traffic records","VPC Flow Logs","Archive to S3; note: Flow Logs have a delay of up to 15 minutes \u2014 archive immediately to prevent gap","Duration of incident window plus 30 days"],["Application logs","CloudWatch Logs","Export log groups covering incident window to S3; set retention to max during incident","Duration of incident window plus 90 days"],["Database query logs","RDS audit logs (if enabled), CloudTrail data events","Confirm RDS audit logging was enabled before incident \u2014 if not, this evidence does not exist","Duration of incident window"],["Lambda function versions","Lambda version history, ECR image digests","Record function version ARNs deployed during incident window; do not delete versions","Until investigation closed"],["IAM activity","CloudTrail: IAM events","Export CloudTrail filtered to IAM events for incident period and 30 days prior","Until investigation closed"],["WAF logs","CloudFront/WAF logs in S3","Confirm WAF logging was enabled; archive logs for incident window","Duration of incident window plus 30 days"]].map(e=>{let[n,i,t,s]=e;return(0,d.jsxs)("tr",{children:[(0,d.jsx)("td",{children:(0,d.jsx)(c.OH,{children:n})}),(0,d.jsx)("td",{className:"dim",children:i}),(0,d.jsx)("td",{children:t}),(0,d.jsx)("td",{style:{color:"#10b981",fontSize:"0.82rem"},children:s})]},n)})})]})}),(0,d.jsx)(c.Pq,{variant:"warning",children:(0,d.jsxs)("p",{children:[(0,d.jsx)("strong",{children:"Critical gap:"})," RDS audit logging and CloudTrail data events are not enabled by default. If they were not enabled before the incident, the database query history and S3 access history for the incident window do not exist. A PFI investigation without this evidence significantly increases the difficulty of determining whether CHD was accessed. Enable these before an incident, not during."]})}),(0,d.jsx)(c.H2,{children:"Common QSA Findings When Reviewing Payment Runbooks"}),(0,d.jsx)(c.bY,{children:[["No incident classification",'The runbook has one response path \u2014 operational. There is no branch for "suspected security incident." A QSA cannot confirm that the entity would escalate a payment anomaly to a security incident response.'],["Contact details are role-based not named",'"N

1otify the CISO" does not satisfy Req 12.10.3. The CISO must be named, with a direct contact number and backup contact. Role-based references become useless when the role is vacant.'],["Acquirer notification absent",'Most runbooks reference notifying "the payment processor." The acquirer is a separate entity and has a separate \u2014 and stricter \u2014 notification timeline. QSAs will flag the absence of acquirer contact details.'],["Evidence preservation not mentioned",'Runbooks that proceed directly from "incident detected" to "restore service" give no instruction on evidence preservation. A QSA treating this as a security incident finding will note that evidence destruction is possible under the current runbook.'],["No annual test evidence","The runbook exists but there is no evidence it was tested in the last 12 months. A document that has never been exercised does not satisfy Req 12.10.2. Tabletop exercise records must be produced."],["Version not controlled","A runbook without a version number, author, and last-reviewed date cannot be confirmed as current. QSAs will request the version history and flag runbooks that have not been reviewed within 12 months."]].map(e=>{let[n,i]=e;return(0,d.jsxs)("li",{children:[(0,d.jsx)(t.g,{icon:"circle-xmark",className:"bad"}),(0,d.jsxs)("span",{children:[(0,d.jsxs)(c.OH,{children:[n,":"]})," ",i]})]},n)})}),(0,d.jsx)(r.A,{toolName:"Failure Playbook Generator",toolPath:"/tools/failure-playbook",toolDescription:"Generate a QSA-ready payment failure runbook \u2014 structured to satisfy PCI DSS 4.0.1 Requirement 12.10, with escalation matrices, rollback procedures, and evidence fields formatted for audit review.",faIcon:"book-open",ctaLabel:"Generate Failure Playbook"})]}),(0,d.jsx)(a.A,{toolName:"Failure Playbook Generator",toolPath:"/tools/failure-playbook",dismissKey:"payment-failure-runbook"})]})}}}]);