PCI Compliance

[#1]

If we have an existing set of APIs running on Apigee Cloud and now wants to apply PCI Compliance Pack, do we need to modify or redeploy the existing APIs? Any best practices to follow while applying the PCI compliance pack will be very useful. What are the key considerations while we chose to apply the PCI Compliance Pack on our Apigee Cloud setup?

[anilsr · Accepted solution]

@Prettyp , Great Question, Welcome to Apigee Community !

NO, You don't need to modify or redeploy the existing APIs.

Regarding, What are the key considerations while we chose to apply the PCI Compliance Pack on our Apigee Cloud setup?

For a customer to be PCI compliant on Apigee Edge Public Cloud, there are some actions and processes the customer owns under the 'Shared Responsibility Model.' You can find more about same in our docs section here.

Hope it helps. Keep us posted moving forward if any.

[kurtkanaskie]

You will have to review your designs to ensure no PCI data is being exposed, especially look for use of cache policies since the L2 cache is persistent storage and is not disabled. That's documented in the link Anil shared.