PCI DSS in Kubernetes and Containers: Meeting Requirements 1, 2, 6 and 10

Req 1 — network

NetworkPolicies, service mesh policies, ingress isolation, and documented allowed flows.

Req 2 — hardening

CIS-aligned node/cluster baselines, disabled insecure APIs, secrets not in env vars for PAN.

Req 6 — secure change

Image scanning in CI, admission controls, change tickets for cluster config.

Req 10 — logging

API server audit logs, container runtime logs, and app logs to SIEM with time sync.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Is Kubernetes automatically out of scope with tokens?

Only if CHD never touches the cluster and connective tissue agrees — prove it.

Who patches nodes?

Document shared responsibility with the cloud K8s offering.

Service mesh required?

Not mandated — segmentation and encryption must still be evidenced.

Related Resources

• PCI GCP
• Time sync
• ThreatHawk