Operating System
PCIComplianceHubLast updated
The software that manages a computer's hardware and software resources, providing a platform for applications to run. Ensuring the security and proper configuration of operating systems is crucial for maintaining the security of cardholder data and achieving PCI DSS compliance.
Applies to. The operating system is named in four places. Where disk-level or partition-level encryption is used to render PAN unreadable, logical access to it must be managed separately from native operating system authentication and access control (3.5.1.3); anti-malware must be enabled on every operating system type identified as at risk for malware (5.3.2); vulnerability identification and risk ranking must cover third-party software including operating systems (6.3.1); and network-layer penetration tests must encompass operating systems as well as the components that support network functions (11.4.1).
Limits. 5.3.2 is tested against operating system types identified as at risk for malware, not against every operating system in the environment.
Sources. PCI DSS v4.0.1 (June 2024)