PCI DSS V 4.0.1 - Payment Card Industry Data Security Standard

An Overview of Core PCI DSS Requirements

PCI DSS v4.0.1 has not introduced new requirements but has refined existing ones through clarifications, updated guidance, and minor formatting changes. The core principles of the standard remain unchanged and continue to provide a foundation for cardholder data protection, covering both technical and operational safeguards from network security to physical protections.

Requirement 1: Install and maintain network security controls

Configure and manage firewalls and segmentation rules to block unauthorized access into the cardholder data environment (CDE).

Requirement 2: Apply secure configurations to system components

Remove default settings, disable unnecessary features and close misconfigurations to reduce any gaps.

Requirement 3: Protect stored cardholder data

PCI DSS v4.0.1 reinforces the ban on storing sensitive authentication data (SAD) post-authorization, except for issuer exemptions, and refines guidance on applicability.

Requirement 4: Encrypt transmission of cardholder data over public networks

Use secure protocols (e.g., TLS 1.2+) to prevent interception when data travels across untrusted networks.

Requirement 5: Secure systems against malware

Deploy and update anti-malware tools to shield CDE from malicious software.

Requirement 6: Develop and maintain secure systems and software

Follow secure development practices and patch vulnerabilities quickly. PCI DSS v4.0.1 requires critical vulnerabilities to be remediated within 30 days, with non-critical fixes based on risk-based timelines.

Requirement 7: Restrict access based on business need-to-know

Grant access only to individuals with a clear, legitimate business need.

Requirement 8: Identify and authenticate access

Assign unique IDs, enforce strong authentication, and expand MFA usage to verify user access.

Requirement 9: Restrict physical access to cardholder data

Use physical barriers such as locks, keycards, and access logs to secure devices containing CHD.

Requirement 10: Log and monitor access to system components

Maintain audit trails to capture user activities and review them regularly for anomalies.

Requirement 11: Test security of systems and networks regularly

Conduct vulnerability scans, penetration testing, and wireless assessments to uncover weaknesses before attackers do.

Requirement 12: Maintain security policies and programs

Implement governance, training and risk management to ensure continuous compliance. PCI DSS v4.0.1 clarifies that service providers must also assist customers by providing documentation and evidence upon request.