PCI DSS v4.0.1 reference: where to start

This is the reference side of PCIComplianceHub: the text of PCI DSS v4.0.1, control by control, with guidance written against it. Everything below is one link away, and every page says where its words come from. What the platform is and how this material is checked is on About and the editorial policy.

The standard

Start with the PCI DSS v4.0.1 overview: the dates that matter, the six goals the twelve requirements are grouped under, and the two ways a control can be validated.

Each requirement has its own page: what it is asking, who it applies to, its controls in a table, the evidence an assessor will ask for, and where it commonly fails.

Requirement	Controls
1: Install and Maintain Network Security Controls	19
2: Apply Secure Configurations to All System Components	11
3: Protect Stored Account Data	29
4: Protect Cardholder Data with Strong Cryptography During Transmission	6
5: Protect All Systems and Networks from Malicious Software	13
6: Develop and Maintain Secure Systems and Software	19
7: Restrict Access by Business Need to Know	12
8: Identify Users and Authenticate Access	29
9: Restrict Physical Access to Cardholder Data	27
10: Log and Monitor All Access	27
11: Test Security of Systems and Networks Regularly	21
12: Support Information Security with Organizational Policies	37

Every one of the 250 controls has a page: the requirement in full, the testing procedures an assessor uses to verify it, guidance on meeting it, what to prepare, related controls, the glossary terms that name it, and the source. All controls lists them in order.

Which SAQ applies

Find my SAQ asks how you take payments and tells you which Self-Assessment Questionnaire fits, with a record you can keep. SAQ requirements mapping sets out the SAQ eligibility criteria, how many requirements each e-commerce method carries, and why a fully outsourced e-commerce merchant faces so few.

The glossary's SAQ entries are the reading list: SAQ, SAQ A, SAQ A-EP, SAQ D, and the merchant level that decides how you validate at all.

The terms

The glossary explains the standard's vocabulary in its own words, cites the Council's glossary where the Council defines a term, and links each term to the controls it sits in. Two groups carry the most depth and are the place to start:

• Payment pages and browser monitoring, the terms Requirements 6.4.3 and 11.6.1 are written in: payment page script, script inventory, Content Security Policy, Subresource Integrity, change and tamper detection, e-skimming.
• Scope, the terms that decide what PCI DSS applies to: account data, cardholder data environment, connected-to and security-impacting systems, network segmentation, truncation, service provider.

Evidence

What an assessor will ask for is on the pages themselves rather than in a separate guide. Each requirement page has a section headed "Evidence your assessor will ask for" (Requirement 6, for example), and each control page has "What the assessor will examine", the testing procedures from the standard, and, where guidance has been written, "What to prepare" (6.4.3, for example). The SAQ record from Find my SAQ carries a starting list of evidence for the questionnaire it recommends, not its full control set.

Tools

Each tool produces evidence for specific controls, and its control page says what it does and does not cover.

• SSL/TLS scan: certificate validity, TLS versions and cipher suites against 4.2.1.
• Payment page script inventory: every script that loads on a monitored payment page, hashed so a later change is detectable, with the decision and justification for each, for 6.4.3.
• Payment page header monitoring: the security-impacting response headers of each monitored page on every scheduled browser visit, with an alert when one changes, for 11.6.1. Needs an account.

Training and the directory

Front Office Payment Security is a seven-module course for staff who handle terminals, card-present payments, and phone and mail orders, with an assessment and a certificate. Find an assessor lists Qualified Security Assessors and Approved Scanning Vendors from the PCI Security Standards Council's own listings, refreshed on each deployment.

About this material

Everything here is written against PCI DSS v4.0.1 (June 2024). Requirement text and testing procedures are reproduced from the standard, ©2006-2024 PCI Security Standards Council, LLC, and the commentary is our own. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. About says who publishes it; the editorial policy says how it is produced, checked, dated and corrected.