PCI DSS v4.0

Req 1 — Network Security Controls

Install and maintain network security controls — firewalls segmenting the Cardholder Data Environment (CDE) from untrusted networks, with documented ruleset reviews every 6 months.

Req 2 — Secure Configurations

Apply secure configurations to all system components — default passwords changed, unnecessary services disabled, configuration standards documented and applied.

Req 3 — Protect Stored Account Data

Minimise stored cardholder data — PAN must be rendered unreadable (AES-256/tokenisation). SAD must not be stored after authorisation. Retain only what is legally/business required.

Req 4 — Protect Data in Transit

Encrypt PAN during transmission over open/public networks — TLS 1.2+ required, TLS 1.3 recommended. Document all locations where PAN is transmitted.

Req 6 — Secure Systems & Software

Protect all system components from known vulnerabilities — patch within defined timeframe (critical: 1 month), secure development practices, web application firewall (WAF) for public-facing apps.

Req 7 — Restrict Access by Business Need

Implement access control systems ensuring CDE access is granted only to individuals whose job requires it — role-based access with documented approval.

Req 8 — Identify Users & Authenticate Access

Unique user IDs for all CDE users — MFA for all non-console admin access and all remote access to CDE (v4.0 expanded MFA requirements). Password minimum 12 characters.

Req 11 — Test Security Regularly

Quarterly internal vulnerability scans, annual external penetration test (PCI SSC-compliant methodology), quarterly ASV scans (external IPs), file integrity monitoring.

Req 12 — Support Information Security with Policies

Maintain an information security policy — security awareness training (annual), incident response plan (tested annually), third-party service provider management programme.