Prioritized Approach
PCIComplianceHubLast updated
A supporting tool published by the PCI Security Standards Council that sorts PCI DSS requirements into six milestones, ordered so the controls that most reduce breach risk come first, such as removing stored sensitive authentication data before tackling later refinements. It helps an organization sequence a remediation programme and show measurable progress to an acquirer. It is a planning aid only: working through the milestones does not confer partial compliance, and full compliance is still required.
Applies to. PCI DSS v4.0.1 does not reference the Prioritized Approach in any requirement; it is a separate Council document, published alongside the standard, that maps each requirement to one of six milestones. Merchants working towards first-time compliance, often at an acquirer's request, use it to order remediation and to report progress. At assessment every requirement is tested whatever its milestone.
Limits. It is a planning aid, not an assessment method; reaching a milestone is not a compliance status and does not replace a ROC or SAQ.