PCI DSS v4.0.1: the evidence behind each requirement

280 requirements. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.

Req 1: Network Security Controls

1.1.1Requirement 1 policies and procedures governed hard 1.1.2Requirement 1 roles and responsibilities assigned hard 1.2.1Ruleset configuration standards for NSCs easy 1.2.2Network connection and NSC changes under change control moderate 1.2.3Accurate network diagram of CDE connections easy 1.2.4Accurate data-flow diagram for account data moderate 1.2.5Allowed services, protocols and ports justified moderate 1.2.6Security features for insecure services in use moderate 1.2.7Six-monthly review of NSC configurations moderate 1.2.8NSC configuration files secured and consistent easy 1.3.1Inbound CDE traffic restricted easy 1.3.2Outbound CDE traffic restricted easy 1.3.3NSCs between wireless networks and the CDE moderate 1.4.1NSCs between trusted and untrusted networks hard 1.4.2Restricting traffic entering trusted networks from outside moderate 1.4.3Anti-spoofing measures at trusted boundary easy 1.4.4Cardholder data stores not reachable from untrusted networks easy 1.4.5Internal IP and routing disclosure limited moderate 1.5.1Security controls on dual-connected devices easy

Req 2: Secure Configurations

2.1.1Requirement 2 policies and procedures governed hard 2.1.2Requirement 2 roles and responsibilities assigned moderate 2.2.1System configuration standards maintained easy 2.2.2Vendor default accounts managed easy 2.2.3Primary functions with different security levels managed moderate 2.2.4Only necessary functionality enabled hard 2.2.5Insecure services, protocols or daemons secured moderate 2.2.6System security parameters configured against misuse easy 2.2.7Non-console administrative access encrypted easy 2.3.1Wireless vendor defaults changed or confirmed secure easy 2.3.2Wireless encryption keys changed on triggers easy

Req 3: Protect Stored Account Data

3.1.1Requirement 3 policies and procedures maintained and in use moderate 3.1.2Assigned duties for Requirement 3 activities hard 3.2.1Data retention and disposal minimise stored account data hard 3.3.1SAD not retained after authorization, even encrypted moderate 3.3.1.1Full track data not retained after authorization hard 3.3.1.2Card verification code not retained after authorization moderate 3.3.1.3PIN and PIN block not retained after authorization easy 3.3.2Pre-authorization SAD stored electronically is strongly encrypted hard 3.3.3Issuer SAD storage limited, justified and encrypted hard 3.4.1PAN masked on display except for authorized roles moderate 3.4.2Remote access blocks copying or relocating PAN easy 3.5.1Stored PAN rendered unreadable moderate 3.5.1.1PAN hashes are keyed cryptographic hashes hard 3.5.1.2Disk or partition encryption only on removable media hard 3.5.1.3Disk encryption access independent of OS authentication moderate 3.6.1Procedures protect keys against disclosure and misuse hard 3.6.1.1Service provider cryptographic architecture documented hard 3.6.1.2Permitted storage forms for secret and private keys moderate 3.6.1.3Cleartext key component access limited to minimum custodians moderate 3.6.1.4Cryptographic keys kept in fewest locations moderate 3.7.1Generation of strong cryptographic keys moderate 3.7.2Secure distribution of cryptographic keys moderate 3.7.3Secure storage of cryptographic keys easy 3.7.4Key changes at end of cryptoperiod moderate 3.7.5Retirement, replacement or destruction of keys hard 3.7.6Split knowledge and dual control for manual key operations hard 3.7.7Prevent unauthorized substitution of keys moderate 3.7.8Key custodians formally acknowledge responsibilities hard 3.7.9Key guidance for service provider customers hard

Req 4: Protect Cardholder Data in Transit

4.1.1Requirement 4 policies and procedures maintained and communicated moderate 4.1.2Requirement 4 roles and responsibilities assigned hard 4.2.1Strong cryptography safeguards PAN over public networks moderate 4.2.1.1Inventory of trusted transmission keys and certificates moderate 4.2.1.2Wireless networks use strong cryptography easy 4.2.2PAN secured when sent by end-user messaging moderate

Req 5: Anti-Malware

5.1.1Requirement 5 policies and procedures maintained and communicated moderate 5.1.2Requirement 5 roles and responsibilities assigned hard 5.2.1Anti-malware deployed on all system components moderate 5.2.2Anti-malware detects and handles all known malware easy 5.2.3Periodic evaluation of components not at risk from malware moderate 5.2.3.1Targeted risk analysis sets evaluation frequency hard 5.3.1Anti-malware kept current through automatic updates moderate 5.3.2Periodic and real-time scans or continuous behavioural analysis easy 5.3.2.1Targeted risk analysis sets malware scan frequency easy 5.3.3Anti-malware covers removable electronic media easy 5.3.4Anti-malware audit logs enabled and retained easy 5.3.5Users cannot disable or alter anti-malware easy 5.4.1Mechanisms detect and protect against phishing easy

Req 6: Secure Systems and Software

6.1.1Requirement 6 policies and procedures maintained and communicated hard 6.1.2Requirement 6 roles and responsibilities assigned hard 6.2.1Secure development of bespoke and custom software hard 6.2.2Annual secure software training for developers hard 6.2.3Code review before release moderate 6.2.3.1Manual code review independence and approval hard 6.2.4Engineering techniques against common software attacks hard 6.3.1Vulnerability identification and risk ranking hard 6.3.2Inventory of bespoke software and components easy 6.3.3Timely installation of security patches hard 6.4.1Public web application review or automated protection easy 6.4.2Automated web attack detection and prevention easy 6.4.3Payment page script management moderate 6.5.1Change control procedure for production hard 6.5.2Confirm PCI DSS controls after significant change hard 6.5.3Separate pre-production from production moderate 6.5.4Separate roles between production and pre-production hard 6.5.5No live PANs in pre-production hard 6.5.6Remove test data and accounts before production hard

Req 7: Restrict Access by Need to Know

7.1.1Requirement 7 policies and procedures maintained moderate 7.1.2Requirement 7 roles and responsibilities assigned hard 7.2.1Access control model defined moderate 7.2.2User access assigned by job function and least privilege easy 7.2.3Privileges approved by authorized personnel moderate 7.2.4User accounts and privileges reviewed every six months moderate 7.2.5Application and system accounts least privilege easy 7.2.5.1Application and system account access reviewed periodically moderate 7.2.6Query access to stored cardholder data restricted moderate 7.3.1Need-to-know access control system covers all components moderate 7.3.2Access control system enforces role-based permissions moderate 7.3.3Access control default deny all moderate

Req 8: Identify and Authenticate Users

8.1.1Requirement 8 policies and procedures maintained moderate 8.1.2Requirement 8 roles and responsibilities assigned hard 8.2.1Unique ID assigned to every user hard 8.2.2Shared and generic IDs only by exception easy 8.2.3Service provider unique factors per customer moderate 8.2.4User ID lifecycle changes authorized easy 8.2.5Terminated users' access revoked immediately easy 8.2.6Inactive accounts removed within 90 days easy 8.2.7Third-party remote access accounts controlled moderate 8.2.8Re-authentication after 15 minutes idle easy 8.3.1Access authenticated with at least one factor easy 8.3.2Authentication factors unreadable with strong cryptography easy 8.3.3Identity verified before factor changes easy 8.3.4Lockout after 10 attempts for 30 minutes easy 8.3.5Initial and reset passwords unique and changed hard 8.3.6Password minimum length 12 and complexity easy 8.3.7No reuse of last four passwords easy 8.3.8Authentication policies communicated to users hard 8.3.9Single-factor passwords changed every 90 days or dynamic analysis easy 8.3.10Service provider customer password guidance hard 8.3.10.1Service provider customer passwords 90 days or dynamic easy 8.3.11Tokens, smart cards and certificates individually assigned moderate 8.4.1MFA for non-console administrative CDE access easy 8.4.2MFA for all non-console CDE access easy 8.4.3MFA for remote access that could reach CDE moderate 8.5.1MFA system resistant to replay and bypass moderate 8.6.1Interactive use of system accounts controlled easy 8.6.2No hard-coded passwords for interactive system accounts easy 8.6.3System account passwords protected against misuse easy

Req 9: Restrict Physical Access

9.1.1Requirement 9 policies and procedures maintained moderate 9.1.2Requirement 9 roles and responsibilities assigned hard 9.2.1Facility entry controls for CDE systems hard 9.2.1.1Monitoring of entry to sensitive areas easy 9.2.2Controls on publicly accessible network jacks hard 9.2.3Physical protection of network hardware and lines hard 9.2.4Locking of consoles in sensitive areas easy 9.3.1Personnel physical access procedures for the CDE moderate 9.3.1.1Personnel access to sensitive areas controlled moderate 9.3.2Visitor access procedures for the CDE hard 9.3.3Visitor badges returned or deactivated easy 9.3.4Visitor logs for facility and sensitive areas easy 9.4.1Physical security of all media hard 9.4.1.1Secure storage location for offline backups moderate 9.4.1.2Annual review of offline backup location security hard 9.4.2Classification of media by data sensitivity moderate 9.4.3Securing media sent outside the facility moderate 9.4.4Management approval for media leaving facility hard 9.4.5Inventory logs of electronic media moderate 9.4.5.1Annual inventories of electronic media hard 9.4.6Destruction of hard-copy materials hard 9.4.7Destruction of electronic media moderate 9.5.1Protection of POI devices from tampering hard 9.5.1.1Current register of POI devices easy 9.5.1.2Periodic inspection of POI device surfaces hard 9.5.1.2.1Risk-based frequency and type of POI inspections hard 9.5.1.3Training for personnel in POI environments hard

Req 10: Logging and Monitoring

10.1.1Requirement 10 policies and procedures maintained and in use hard 10.1.2Roles for logging and monitoring assigned and understood hard 10.2.1Audit logging enabled on all system components easy 10.2.1.1Logs capture individual user access to cardholder data easy 10.2.1.2Logs capture all administrative actions easy 10.2.1.3Access to the audit logs is itself logged easy 10.2.1.4Logs capture invalid logical access attempts easy 10.2.1.5Logs capture changes to identification and authentication credentials easy 10.2.1.6Logs capture initialization and stopping of audit logs easy 10.2.1.7Logs capture creation and deletion of system-level objects easy 10.2.2Required details recorded for each auditable event moderate 10.3.1Audit log read access limited to job need hard 10.3.2Audit log files protected from modification easy 10.3.3Audit logs promptly backed up to central secure storage easy 10.3.4File integrity monitoring on audit logs easy 10.4.1Daily review of security-relevant logs moderate 10.4.1.1Automated mechanisms used for audit log review moderate 10.4.2Periodic review of all other system component logs hard 10.4.2.1Periodic log review frequency set by targeted risk analysis hard 10.4.3Exceptions and anomalies from log review addressed easy 10.5.1Keep logs 12 months, latest three months online easy 10.6.1System clocks synchronized with time-sync technology easy 10.6.2Systems configured to correct and consistent time easy 10.6.3Time sync configuration and time data protected easy 10.7.1Service providers detect critical control failures (superseded) easy 10.7.2Detect and alert on critical security control failures moderate 10.7.3Respond promptly to critical security control failures hard

Req 11: Test Security Regularly

11.1.1Requirement 11 policies and procedures managed moderate 11.1.2Roles for security testing assigned and understood hard 11.2.1Detect authorized and rogue wireless access points moderate 11.2.2Inventory of authorized wireless access points hard 11.3.1Quarterly internal vulnerability scans moderate 11.3.1.1Lower-risk vulnerabilities handled per risk analysis moderate 11.3.1.2Authenticated internal vulnerability scanning easy 11.3.1.3Internal scans after significant change hard 11.3.2Quarterly ASV external vulnerability scans hard 11.3.2.1External scans after significant change easy 11.4.1Penetration testing methodology defined and implemented hard 11.4.2Internal penetration testing annually and after change hard 11.4.3External penetration testing annually and after change hard 11.4.4Correct exploitable findings from penetration tests moderate 11.4.5Annual segmentation penetration testing hard 11.4.6Service provider segmentation testing every six months moderate 11.4.7Multi-tenant providers support customer penetration testing moderate 11.5.1IDS/IPS monitoring of CDE traffic easy 11.5.1.1Service providers detect covert malware channels moderate 11.5.2Change detection on critical files moderate 11.6.1Payment page tamper detection easy

Req 12: Information Security Policies

12.1.1Overall information security policy established and disseminated moderate 12.1.2Security policy reviewed annually and updated as needed moderate 12.1.3Security roles defined and acknowledged by all personnel hard 12.1.4Executive ownership of information security formally assigned hard 12.2.1Rules for acceptable use of end-user technology moderate 12.3.1Targeted risk analysis for flexible-frequency requirements hard 12.3.2Targeted risk analysis for each customized-approach requirement hard 12.3.3Cryptographic cipher suite and protocol inventory reviewed annually moderate 12.3.4Annual review of hardware and software technologies hard 12.4.1Executive responsibility for a PCI DSS compliance program hard 12.4.2Quarterly reviews that personnel follow security procedures moderate 12.4.2.1Documentation of quarterly operational reviews easy 12.5.1Inventory of in-scope system components moderate 12.5.2Annual and change-driven scope confirmation moderate 12.5.2.1Six-monthly scope confirmation for service providers moderate 12.5.3Scope review after significant organisational change hard 12.6.1Formal security awareness program hard 12.6.2Awareness program reviewed annually and updated moderate 12.6.3Security awareness training on hire and annually with acknowledgment moderate 12.6.3.1Awareness training covers phishing and social engineering easy 12.6.3.2Awareness training covers acceptable use of end-user technologies moderate 12.7.1Pre-hire screening of personnel with CDE access moderate 12.8.1List of third-party service providers hard 12.8.2TPSP contracts acknowledging account data responsibility hard 12.8.3Due diligence before engaging TPSPs hard 12.8.4Annual monitoring of TPSP compliance status hard 12.8.5Responsibility allocation between entity and TPSPs hard 12.9.1TPSP written acknowledgments to customers hard 12.9.2TPSP support for customer information requests moderate 12.10.1Incident response plan ready for activation hard 12.10.2Annual review and testing of the incident response plan moderate 12.10.3Incident response personnel available 24/7 moderate 12.10.4Periodic training for incident response personnel moderate 12.10.4.1Responder training frequency set by targeted risk analysis hard 12.10.5Plan covers alerts from security monitoring systems moderate 12.10.6Plan evolved from lessons learned and industry developments moderate 12.10.7Response procedures for PAN found in unexpected locations hard

Appendix A1: Additional requirements for multi-tenant service providers

A1.1.1Logical separation between provider and customer environments hard A1.1.2Customers limited to their own cardholder data and CDE hard A1.1.3Customers restricted to their allocated resources easy A1.1.4Penetration testing of tenant separation every six months moderate A1.2.1Per-customer audit logging consistent with Requirement 10 moderate A1.2.2Support for prompt forensic investigation of any customer hard A1.2.3Customer reporting and remediation of incidents and vulnerabilities hard

Appendix A2: Entities using SSL/early TLS for card-present POS POI terminal connections

A2.1.1Confirm SSL/early TLS POS POI devices resist known exploits moderate A2.1.2Risk Mitigation and Migration Plan for SSL/early TLS connections hard A2.1.3Service providers offer a secure protocol option easy

Appendix A3: Designated Entities Supplemental Validation (DESV)

A3.1.1Executive management responsibility for the PCI DSS compliance program hard A3.1.2Formal PCI DSS compliance program elements hard A3.1.3Defined and assigned PCI DSS compliance roles hard A3.1.4Annual PCI DSS training for compliance personnel moderate A3.2.1Quarterly and change-driven scope documentation and validation hard A3.2.2Scope impact of every system or network change moderate A3.2.2.1Post-change confirmation that PCI DSS controls are in place moderate A3.2.3Scope review after organizational structure changes hard A3.2.4Six-monthly penetration testing of segmentation controls hard A3.2.5Data-discovery methodology for cleartext PAN easy A3.2.5.1Annual confirmation of data-discovery effectiveness hard A3.2.5.2Response procedures when cleartext PAN is found outside the CDE hard A3.2.6Mechanisms to detect and block cleartext PAN leaving the CDE easy A3.2.6.1Response procedures for attempted removal of cleartext PAN easy A3.3.1Prompt detection and alerting of critical security control failures easy A3.3.1.1Prompt response to critical security control failures moderate A3.3.2Annual review of hardware and software technologies hard A3.3.3Quarterly review that BAU activities are followed hard A3.4.1Six-monthly review of user accounts and access privileges moderate A3.5.1Methodology for prompt detection of attack patterns easy