Open Access

Automation of Compliance Control Processes According to PCI DSS Standards in Hybrid Cloud Environments

https://doi.org/10.55640/ijctisn-v03i04-01

PDF

Aghasi Gevorgyan ¹ ,

⁴ Head of Network Infrastructure, Armenian Card CJSC

Abstract

The article addresses the problem of transforming compliance control with the PCI DSS 4.0.1 standard in hybrid cloud environments from an episodic audit practice into a continuous risk management function. It is shown that increasing infrastructure complexity, the deferred mandatory status of certain measures, and the accelerating pace of change render manual compliance operationally untenable. Meanwhile, the distribution of control points across hybrid/multi-cloud leads to the blurring of assessment scope, accountability boundaries, and control verifiability, which determines the high relevance of the study. The purpose of this work is to formalize a framework for automating PCI DSS compliance processes in a hybrid architecture, combining normative analysis with an engineering representation of controls. Scientific novelty consists in interpreting scoping and segmentation as a verifiable hypothesis. In projecting the principles of automated continuous compliance (policy-as-code, shifting left of checks, and formalization of the evidence base as a managed artifact) onto the specifics of PCI DSS, and in proposing a reference architecture and a phased automation roadmap that integrates management planes, telemetry, response processes, and an immutable evidence perimeter. The main conclusions indicate that PCI DSS compliance in a hybrid cloud can be maintained as a system property, dependent on continuous dependency inventory, a disciplined segmentation approach, standardized identity governance, a formalized shared-responsibility model, and machine-executable policies embedded into the change lifecycle. The article will be useful to hybrid infrastructure architects, information security specialists, payment service owners, and auditors involved in assessing and building PCI DSS-compatible solutions.

Keywords

hybrid cloud environments, continuous compliance, compliance control automation, policy-as-code

References

Ali, S., Talpur, D. B., Abro, A., Alshudukhi, K. S. S., Alwakid, G. N., Humayun, M., Bashir, F., Wadho, S. A., & Shah, A. (2025). Security and privacy in multi-cloud and hybrid cloud environments: Challenges, strategies, and future directions. Computers & Security, 157, 104599. https://doi.org/10.1016/j.cose.2025.104599

Angermeir, F., Fischbach, J., Moyón, F., & Méndez, D. (2024). Towards Automated Continuous Security Compliance. Proceedings of the 18th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, 440–446. https://doi.org/10.1145/3674805.3690748

Haj, B., Laborde, R., Benzekri, A., Kandi, M. A., & Ferreira, A. (2025). Identity Management in Cross-Cloud Environments: Towards Self-Sovereign Identities Using Current Solutions. Lecture Notes in Computer Science, 15456, 56–71. https://doi.org/10.1007/978-3-031-89350-6_4

PCI. (n.d.). Glossary. PCI Security Standards Council. Retrieved December 1, 2025, from https://www.pcisecuritystandards.org/glossary/

PCI. (2024). Payment Card Industry Data Security Standard. PCI. https://www.middlebury.edu/sites/default/files/2025-01/PCI-DSS-v4_0_1.pdf

PCI Security Standards Council. (2016). Guidance for PCI DSS Scoping and Network Segmentation. PCI Security Standards Council. https://listings.pcisecuritystandards.org/documents/Guidance-PCI-DSS-Scoping-and-Segmentation_v1.pdf

Tuyishime, E., Balan, T. C., Cotfas, P. A., Cotfas, D. T., & Rekeraho, A. (2023). Enhancing Cloud Security, Proactive Threat Monitoring and Detection Using a SIEM-Based Approach. Applied Sciences, 13(22), 12359. https://doi.org/10.3390/app132212359

Vanga, P. R. (2025). Demystifying Cloud Security: Understanding Shared Responsibility Models. International Journal of Information Technology and Management Information Systems, 16(1), 347–357. https://doi.org/10.34218/ijitmis_16_01_026

Wang, Y., & Yang, X. (2025). Machine Learning-Based Cloud Computing Compliance Process Automation. Automation and Machine Learning, 6(1). https://doi.org/10.23977/autml.2025.060105

Most read articles by the same author(s)

1 2 3 4 5 6 7 > >>

International Journal of Cyber Threat Intelligence and Secure Networking

Automation of Compliance Control Processes According to PCI DSS Standards in Hybrid Cloud Environments

Abstract

Keywords

References

Most read articles by the same author(s)

Similar Articles