Loading...
Payment Card Industry Data Security Standard v4.0.1
PCI DSS is an industry standard — not a government regulation — that protects cardholder data wherever it is stored, processed, or transmitted. Founded by the five major card brands, it comprises 12 requirements across 6 goals. Version 4.0.1 (published June 2024) is the current standard, introducing 64 new requirements over v3.2.1 including a customised approach for compliance.
12
Requirements
6
Goals
4
Compliance Levels
v4.0.1
Current Version
Goal 1: Install and maintain firewall configuration. Do not use vendor-supplied defaults for passwords and security parameters.
Goal 2: Protect stored cardholder data. Encrypt transmission of cardholder data across open, public networks.
Goal 3: Protect systems against malware. Develop and maintain secure systems and applications.
Goal 4: Restrict access by need-to-know. Identify and authenticate access. Restrict physical access to cardholder data.
Goal 5: Track and monitor all access to network resources and cardholder data. Regularly test security systems and processes.
Goal 6: Maintain a policy that addresses information security for all personnel.
Define your Cardholder Data Environment (CDE): all systems that store, process, or transmit cardholder data, plus connected systems. Determine your compliance level.
Assess current controls against all 12 PCI DSS v4.0.1 requirements. Identify gaps especially in the 64 new requirements added in v4.0.
Implement required controls: network segmentation, encryption, access controls, logging, vulnerability management, and security policies.
Complete the appropriate Self-Assessment Questionnaire or engage a Qualified Security Assessor (QSA) for a formal Report on Compliance (RoC).
Submit your Attestation of Compliance (AoC) to your acquiring bank and card brands. Address any findings from the assessment.
PCI DSS is a continuous process: quarterly network scans, annual penetration testing, ongoing monitoring, and staff security awareness training.