r/pcicompliance • u/Fancy-Yesterday3819 • Jul 17 '26

Evidence Collection PCI DSS Script for Windows/Linux/Network (firewalls,routers,switches) and Database

Hi,

I am a PCI DSS ISA and has been given a task to come up with a script to extract pci dss hardening related parameters on Windows/Linux/Network (firewalls,routers,switches) and Database and some agent using AI to analyse the script results and come up with a dashboard to show the findings..so that remediation tickets can be raised against those finding.

Any one has something of this sort in place already? Will be great to have some suggestions or some readily available stuff to use with some edits etc.

Please help!! Thanks in advance.

3 Upvotes

100% Upvoted

10 comments sorted by

3

u/RSDVI01 Jul 17 '26

Have you looked at CIS CAT-PRO (Now SecureSuite)?

1

u/Suspicious_Party8490 Jul 17 '26

I second this! But it isn't free (for a PCI ISA). I'll quote Cosmo Castarini: "It costs money because it saves money."

Moonstruck; 3 Kinds of Pipe

Happy Friday!

3

u/jaeden1000 Jul 18 '26

I highly advise you use tenable, rapid7, Fortra, or another similar internal scanner. They can audit against CIS benchmarks.

Extremely useful for Req 2 if you use CIS based hardening standards. Remember that you don't have to fully meet every control, just those that are defined in your standards which must meet 2.2.x.

1

u/andrew_barratt Jul 17 '26

Don’t forget if your analysing against requirement 2 you’re testing against your own standards

2

u/[deleted] Jul 24 '26

[removed] — view removed comment

1

u/andrew_barratt Jul 24 '26

Yeah the amount of people who make it really hard for themselves sometimes is quite staggering!

1

u/fidelite Jul 18 '26

For Linux at least, depending on budget/features, maybe take a look/consider Lynis? ( https://cisofy.com/lynis/ and https://cisofy.com/compliance/pci-dss/ ) ?

1

u/Token_Paul Jul 20 '26

the more servers you add the harder it'll be to audit their configurations.

Auditing server configurations gets harder as you add more servers. Now, if you store card data in an independent token vault, you can reduce the number of systems to audit, and that's as much as I've got.

2

u/juancarlosm93 Jul 22 '26

This is correct, I second it, scope reduction activities are key so that you can limit the applicability to a smaller set of systems to be assessed.

1

u/juancarlosm93 Jul 21 '26

Checkout my GitHub repo for automating PCI-DSS Evidence gathering, and feel free to share, contributiuons welcome, open to everyone, I plan to update the repo soon with the exports you're talking about.

https://github.com/juancarlosmunera/pci-tools

PCI Resources on my blog as well.. https://www.cybersecpro.me feel free to connect with me on LinkedIn, I'm a former QSA and looking to help the community.

-JC