The Payment Card Industry Data Security Standard (PCI DSS) v4.0 is the global standard for protecting cardholder data. It applies to any organization that stores, processes, or transmits credit card information. PCI DSS is organized into 12 main requirements across 6 goals. Non-compliance can result in fines from $5,000 to $100,000 per month and the loss of ability to process card payments. This guide covers all 12 requirements with plain-English explanations.
The foundation of cardholder data protection: establishing and maintaining secure network boundaries and system configurations.
You must install and maintain firewalls and other network security controls to protect the cardholder data environment (CDE). This includes defining traffic rules, restricting connections, and reviewing configurations at least every six months.
You must not use vendor-supplied defaults for system passwords and other security parameters. All system components must be hardened according to industry-accepted standards before being deployed into the CDE.
Requirements for protecting stored cardholder data and encrypting data transmitted over public networks.
Stored cardholder data must be protected through encryption, truncation, masking, or hashing. You must minimize data storage, never store sensitive authentication data after authorization, and implement strong cryptography for any PAN that must be stored.
Cardholder data must be encrypted with strong cryptography when transmitted over open, public networks. This includes using TLS 1.2 or higher, not sending unencrypted PANs via email or messaging, and protecting wireless networks transmitting cardholder data.
Requirements for protecting systems from malware and maintaining secure systems and software.
You must deploy anti-malware solutions on all systems commonly affected by malicious software. Anti-malware must be kept current, perform periodic scans, generate audit logs, and cannot be disabled by users.
You must establish a process for identifying and managing vulnerabilities in all system components. Security patches must be applied within defined timeframes, custom software must be developed securely, and public-facing web applications must be protected.
Requirements for restricting access to cardholder data on a need-to-know basis and authenticating users.
Access to cardholder data and system components in the CDE must be limited to individuals whose job requires it. You must implement role-based access control, deny access by default, and review access assignments at least every six months.
Every user must have a unique ID. Multi-factor authentication is required for all access into the CDE and all remote access. Passwords must meet complexity requirements, be changed every 90 days, and must not be shared.
Physical access to systems and data in the CDE must be restricted. This includes using access controls for facilities, distinguishing between onsite personnel and visitors, securing media containing cardholder data, and destroying media when no longer needed.
Requirements for tracking and monitoring all access to network resources and cardholder data, and regularly testing security systems.
You must log all user access to cardholder data, all actions taken by administrators, all access to audit trails, invalid access attempts, and changes to authentication mechanisms. Logs must be reviewed daily, retained for at least 12 months, and protected from tampering.
You must regularly test security systems and processes. This includes quarterly wireless analyzer scans, quarterly ASV vulnerability scans, annual penetration testing, file integrity monitoring, and network intrusion detection.
Requirements for maintaining a policy that addresses information security for all personnel.
You must establish, publish, maintain, and disseminate a security policy that addresses all PCI DSS requirements. The policy must be reviewed annually, include a risk assessment process, define security responsibilities, and include an incident response plan. All personnel must be aware of the policy.
PCI DSS v4.0 introduces targeted risk analysis (TRA) for requirements where the entity has flexibility in how often to perform an activity. You must document the frequency chosen, the rationale, and review the analysis at least annually.
You must create, document, and distribute an incident response plan. The plan must address roles and responsibilities, communication procedures, recovery procedures, regulatory notification, and lessons learned. The plan must be tested at least annually.
PCI DSS applies to any organization that stores, processes, or transmits cardholder data. This includes merchants, payment processors, acquirers, issuers, and service providers. Even if you use a third-party payment processor, you may still have PCI DSS obligations.
PCI DSS v4.0 introduces the customized approach (allowing organizations to meet objectives in their own way), targeted risk analysis, enhanced authentication requirements including MFA for all CDE access, and new e-commerce requirements for payment page scripts. Organizations must be fully compliant by March 31, 2025.
PCI DSS has four merchant levels based on annual transaction volume: Level 1 (6M+ transactions, requires annual on-site assessment), Level 2 (1-6M transactions), Level 3 (20K-1M e-commerce transactions), and Level 4 (under 20K e-commerce or up to 1M other transactions). Levels 2-4 typically complete a Self-Assessment Questionnaire (SAQ).
PCI DSS non-compliance can result in fines from $5,000 to $100,000 per month from payment brands, increased transaction fees, and ultimately the loss of ability to process card payments. In the event of a data breach, non-compliant organizations face significantly higher liability.
The customized approach allows organizations to implement controls in their own way to meet a requirement objective, rather than following the prescribed defined approach. This provides flexibility but requires a more rigorous assessment including a customized approach risk analysis.
PCI DSS requires policies covering network security, cardholder data protection, vulnerability management, access control, monitoring and testing, information security, incident response, physical security, vendor management, encryption, password management, and change management. PoliWriter generates all of these.
PoliWriter creates all the policies you need to satisfy PCI DSS v4.0 requirements, customized to your organization. AI-powered, audit-ready, hours not months.
Get Started Free