State-Indexed PCI DSS Compliance: A Formalism for Path-Sensitive Valuation in Adversarial Networked Payment Systems

Payment infrastructures are security-critical networked systems whose control status may change as attacks, remediation, and recovery unfold. In such environments, model-level PCI DSS requirement-check applicability and control satisfaction may vary across intermediate operational states. A deliberately restricted point-in-time terminal-state projection may consequently omit model-level violations represented at intermediate states during malware infection, lateral movement, segmentation failure, service disruption, or subsequent restoration. This paper introduces SCF-PCI, a formal and executable framework for path-sensitive PCI DSS valuation over adversarially evolving payment-system states. The framework defines a PCI valuation domain, separates requirement-check applicability from satisfaction, and assigns state-indexed valuations to admitted checks over reached PCI-valued states. These valuations are then lifted to execution paths, whilst endpoint loss is characterised through restoration, applicability-window closure, and domain exit. SCF-PCI is implemented in OPA Rego using OSCAL-represented PCI DSS control artefacts and evaluated across a ten-scenario analytical corpus involving malware infection, remote compromise, DDoS disruption, spyware-assisted fraud, and recovery paths. The results show that, under the instantiated predicate mappings, state-indexed valuation retains model-level violations that are omitted by the analytical terminal-state projection. The framework provides a formal proof-of-concept for state-aware PCI DSS assessment support in adversarial payment environments, without replacing conventional PCI DSS assessment or assessor judgement.