How to use this tool

Security Controls Matrix — Guide

How to use the security controls matrix to track implementation status across PCI DSS domains, filter by requirement, and export a control inventory for QSA review.

What is this tool for?

A security controls matrix maps your implemented security controls to the compliance requirements they satisfy. It answers the question: "For PCI DSS Requirement 8 (access control), what specific controls do we have, and have they been tested?"

The tool provides a pre-populated matrix of controls across six PCI DSS security domains, with status tracking (Implemented, Partial, Not Implemented, Not Applicable, Tested). Filter by domain or PCI requirement number, add custom controls, and export a complete inventory.

Step-by-step walkthrough

Step 1 — Review the summary cards
  1. The five summary cards show totals for Implemented, Partial, Not Implemented, Not Applicable, and Tested controls.
  2. Focus on the Not Implemented count — these are your security gaps requiring remediation.
Step 2 — Filter by domain or status
  1. Use the domain filter chips to view controls in a specific security area (Network, Encryption, Access Control, etc.).
  2. Use the status filter to show only Not Implemented controls — this gives you your remediation backlog.
  3. Combine domain and status filters to focus on a specific area, e.g. "Not Implemented Encryption controls".
Step 3 — Update control statuses
  1. Click any control row to expand it and update its implementation status.
  2. Add notes recording the specific AWS resources that implement each control (e.g. "KMS key ARN: arn:aws:kms:eu-west-1:123456789:key/...").
  3. Mark controls as Tested once you have evidence of successful testing (penetration test result, config audit, etc.).
Step 4 — Export the control inventory
  1. Click Export CSV to download the full matrix with statuses and notes.
  2. Use the exported file as a control inventory document in your QSA pre-audit package.

Security domains covered

Network SecurityReq 1
Firewall rules, VPC segmentation, security groups, NACLs, WAF configuration, and network access controls between CDE and non-CDE components.
EncryptionReq 3, 4
Encryption at rest (KMS CMKs, AES-256), encryption in transit (TLS 1.2+), key management rotation schedules, and tokenisation controls.
Access ControlReq 7, 8
IAM least privilege, role-based access control, MFA enforcement, service account management, and agent identity controls (PCI DSS v4.0 Req 8.6).
Vulnerability ManagementReq 6
Patch management, security scanning, dependency updates, SAST/DAST tooling, and change control for CDE components.
Logging & MonitoringReq 10
CloudTrail, CloudWatch, VPC Flow Logs, audit log integrity (S3 Object Lock), log retention (12 months, 3 months immediately available), and alerting.
Incident ResponseReq 12
Incident response plan, security event runbooks, breach notification procedures, and regular testing of response capabilities.

Key terms

Security controlA safeguard or countermeasure designed to protect the confidentiality, integrity, or availability of a system. Controls can be technical (encryption, MFA), administrative (policies, procedures), or physical (data centre access).
Control gapA required security control that is not yet implemented. A gap in a PCI DSS-required control is a finding that must be remediated before an audit can be passed.
Compensating controlAn alternative control that provides equivalent protection to a control that cannot be implemented as specified. Must be documented, risk-assessed, and approved by a QSA.
SASTStatic Application Security Testing — automated scanning of source code for security vulnerabilities before deployment. Required by PCI DSS Req 6 for payment application code.
DASTDynamic Application Security Testing — automated security testing of a running application. Simulates attacks from outside the application to find vulnerabilities that SAST may miss.

Frequently asked questions

Ready to map your security controls?
Track implementation status across all PCI DSS domains and export a QSA-ready control inventory.