Ankos

PCI DSS 4.0.1 Evidence Readiness Report

Sample report. This is the output of ankos report --format html against a real AWS account, sanitized for publication. Account ID, identity, and findings are representative — the format is exactly what your QSA opens.
10/12
Requirements Covered
55
Total Checks
16
Ready
20
Action Needed
14
Review

Evidence collected for 10 of 12 applicable requirements. The report leads with this coverage plus the per-status counts above. Ankos reports evidence readiness only — never a graded compliance number; the final compliance determination is made by your QSA.

Account: 123456789012 Region: us-east-1 Collected: 2026-05-26 20:21 UTC Generated: 2026-05-26 20:25 UTC
✗

Requirement 1: Install and maintain network security controls

StatusSeverityCheckDetailPCIRemediation
READY CRITICAL Security groups with open SSH (0.0.0.0/0:22) 1.3.1
READY CRITICAL Security groups with open RDP (0.0.0.0/0:3389) 1.3.1
READY CRITICAL Security groups with unrestricted ingress (0.0.0.0/0 all ports) 1.3.1
ACTION NEEDED HIGH VPC flow logs enabled 1 VPC(s) without flow logs 1.2.2, 10.2.1 Enable VPC flow logs (ALL traffic) to a CloudWatch log group so network activity is captured.
READY HIGH No publicly accessible Lambda functions 1.3.2, 7.2.1
INFO Lambda functions deployed in VPC 0 of 22 functions deployed in VPC
✗

Requirement 2: Apply secure configurations to all system components

StatusSeverityCheckDetailPCIRemediation
READY CRITICAL No publicly accessible RDS instances 1.3.2, 2.2.7
READY HIGH CloudFront distributions enforce HTTPS 4.2.1
ACTION NEEDED HIGH CloudFront uses TLS 1.2+ minimum 1 distribution(s) use deprecated TLS version 4.2.1 Set the CloudFront viewer-certificate minimum protocol to TLS 1.2 (2021).
INFO CloudFront uses SNI (not dedicated IP) 11 distributions using SNI
✗

Requirement 3: Protect stored account data

StatusSeverityCheckDetailPCIRemediation
ACTION NEEDED HIGH KMS key rotation enabled for customer-managed keys 1 customer-managed key(s) without rotation enabled 3.7.4 Enable automatic annual rotation on the customer-managed KMS key.
READY HIGH S3 buckets encrypted at rest 3.4.1
ACTION NEEDED CRITICAL S3 public access blocked 4 bucket(s) without public access block 1.3.2, 7.2.1 Enable S3 Block Public Access (all four settings) on the affected bucket(s).
REVIEW MEDIUM S3 versioning enabled 1/19 bucket(s) have versioning enabled 3.4.1 Enable versioning on S3 buckets to protect against accidental deletion and support recovery.
REVIEW MEDIUM S3 buckets have server access logging 0/19 bucket(s) have access logging enabled 10.2.1 Enable server access logging on all S3 buckets to track access requests.
REVIEW Lambda environment variables encrypted with KMS 22 functions with env vars not encrypted with customer KMS key
REVIEW DynamoDB tables encrypted with customer-managed KMS key 27 tables use default encryption — customer-managed KMS recommended for PCI
READY MEDIUM DynamoDB point-in-time recovery enabled 3.4.1
REVIEW DynamoDB deletion protection enabled 27 tables without deletion protection
REVIEW Macie sensitive data discovery enabled Macie is not enabled — no automated sensitive data discovery
✗

Requirement 4: Protect cardholder data with strong cryptography during transmission

StatusSeverityCheckDetailPCIRemediation
READY HIGH No expired certificates 4.2.1
READY MEDIUM No certificates expiring within 30 days 4.2.1
ACTION NEEDED HIGH CloudFront origin connections use HTTPS 2 origins configured for HTTP-only — data in transit unencrypted 4.2.1 Configure CloudFront origin protocol policy to HTTPS-only to encrypt data between CloudFront and origin servers.
READY MEDIUM CloudFront uses custom SSL certificates 4.2.1
✗

Requirement 5: Protect all systems and networks from malicious software

StatusSeverityCheckDetailPCIRemediation
ACTION NEEDED HIGH AWS Inspector enabled Inspector is not enabled — no automated vulnerability scanning 5.2.1, 11.3.1 Enable AWS Inspector for automated vulnerability scanning across EC2, Lambda, and container images.
✗

Requirement 6: Develop and maintain secure systems and software

StatusSeverityCheckDetailPCIRemediation
ACTION NEEDED MEDIUM ECR scan-on-push enabled 1 repository(ies) without scan-on-push 6.3.1 Enable scan-on-push for ECR repositories to automatically scan images for vulnerabilities.
READY HIGH No ECR images with critical vulnerabilities 6.3.3
REVIEW ECR immutable image tags 0/1 repository(ies) have immutable tags
REVIEW WAF web ACLs configured No WAF web ACLs found — web applications may lack WAF protection
ACTION NEEDED HIGH CloudFront distributions associated with WAF 11 of 11 distributions without WAF protection 6.4.1 Associate a WAF web ACL with CloudFront distributions to protect against common web attacks.
READY MEDIUM Lambda functions use supported runtimes 6.3.2
✓

Requirement 7: Restrict access to system components and cardholder data by business need to know

StatusSeverityCheckDetailPCIRemediation
INFO IAM users inventory 1 users, 38 roles, 0 customer-managed policies
✗

Requirement 8: Identify users and authenticate access to system components

StatusSeverityCheckDetailPCIRemediation
ACTION NEEDED CRITICAL All console users have MFA enabled 1 of 1 console users missing MFA 8.3.1 Enable MFA for all IAM users with console access. Use virtual MFA apps or hardware security keys.
READY CRITICAL Root account has MFA enabled 8.3.1
REVIEW Root account has hardware MFA Root account uses virtual MFA — hardware MFA recommended for PCI
ACTION NEEDED CRITICAL No access keys on root account Root account has active access keys — should be removed 8.6.1 Delete root account access keys. Root should never be used programmatically. Create IAM users or roles instead.
INFO API Gateway throttling configured 0 REST APIs, 2 HTTP APIs with 2 total stages
ACTION NEEDED Password policy configured No password policy is configured
✗

Requirement 10: Log and monitor all access to system components and cardholder data

StatusSeverityCheckDetailPCIRemediation
ACTION NEEDED CRITICAL Multi-region CloudTrail logging enabled No multi-region CloudTrail trail with logging enabled 10.2.1 Enable a multi-region CloudTrail trail to capture API calls across all AWS regions.
REVIEW CloudWatch log groups have retention policies 24 with retention under 365 days — PCI requires minimum 1 year retention
ACTION NEEDED Security-relevant CloudWatch metric filters exist Only 0 of 8 recommended security metric filters found — critical gap in security monitoring
READY CloudWatch alarms have notification actions
INFO CloudWatch alarms configured for security metrics 4 active CloudWatch alarms configured
ACTION NEEDED MEDIUM CloudFront access logging enabled 11 distributions without access logging 10.2.1 Enable access logging for CloudFront distributions to track viewer requests.
READY MEDIUM API Gateway access logging enabled 10.2.1
REVIEW API Gateway X-Ray tracing enabled 2 stages without X-Ray tracing
REVIEW Lambda X-Ray tracing enabled 22 functions without X-Ray tracing
✗

Requirement 11: Test security of systems and networks regularly

StatusSeverityCheckDetailPCIRemediation
ACTION NEEDED CRITICAL GuardDuty enabled GuardDuty not enabled — required for PCI 11.4 intrusion detection 11.4.1 Enable GuardDuty for continuous threat detection. GuardDuty analyzes VPC flow logs, DNS logs, and CloudTrail events.
ACTION NEEDED HIGH AWS Config enabled AWS Config is not enabled — no continuous configuration monitoring 11.5.1 Enable AWS Config to record resource configuration changes for compliance monitoring.
ACTION NEEDED HIGH AWS Inspector vulnerability scanning enabled Inspector is not enabled — no automated vulnerability scanning 11.3.1 Enable Inspector scanning for EC2, Lambda, and ECR to continuously identify vulnerabilities.
ACTION NEEDED HIGH AWS Config enabled and recording AWS Config not recording — required for infrastructure change tracking (PCI 11.5) 11.5.1 Ensure the AWS Config recorder is actively recording. Start the recorder if it's stopped.
ACTION NEEDED AWS Config rules evaluate compliance No AWS Config rules configured — no automated compliance evaluation
ACTION NEEDED Critical infrastructure change detection Insufficient Config rules for critical infrastructure monitoring
REVIEW S3 buckets with versioning for data integrity 18 of 19 buckets do not have versioning — data change tracking unavailable
REVIEW CloudTrail data events track object-level changes No S3 data events — object-level change tracking not enabled