Threat Modeling

Applies to. PCI DSS v4.0.1 does not require threat modelling by name. It is implied in three places: Requirement 6, where developers of bespoke and custom software must use techniques that prevent the common attack classes the standard lists, which presumes someone has worked out which of them apply; Requirement 11, where the penetration testing methodology must take account of the threats and vulnerabilities seen in the last 12 months; and Requirement 12, where the targeted risk analysis used to set control frequencies asks the entity to identify the threats a requirement protects against.