PCI DSS v4.0 Checklist

Sensitive authentication data (SAD) is not retained after authorisation, even if encrypted.

PAN (Primary Account Number) is protected at rest using strong cryptography, truncation, hashing, or tokenisation.

Cryptographic keys used to protect account data are managed with documented key management procedures covering generation, distribution, storage, retirement, and destruction.

Strong cryptography used to safeguard PAN during transmission over open, public networks (TLS 1.2 minimum, TLS 1.3 recommended).

PAN is never sent via end-user messaging technologies (email, instant messaging, SMS, chat) unless using end-to-end encryption.

Anti-malware mechanisms are kept current, active, and generating audit logs.

Anti-phishing mechanisms protect personnel against phishing attacks (email filtering, URL categorisation, user awareness).

A process is in place to identify security vulnerabilities, assign a risk ranking (at minimum high and critical), and remediate according to risk ranking.

Software developed for or by the organisation follows secure coding guidelines and is reviewed for vulnerabilities before release.

Security vulnerabilities in bespoke/custom software are identified, ranked, and addressed including code review and application security testing.

All public-facing web applications are protected against known attacks, either through ongoing security testing or by deploying a WAF.

Access is granted based on documented privilege levels that include role, function, and classification of data that each role can access.

All users are assigned a unique ID before allowing them to access system components or cardholder data.

User IDs and accounts for terminated users are immediately revoked. Inactive accounts disabled within 90 days.

Strong authentication is established and managed for all users, including appropriate MFA for all non-consumer access to system components.

MFA implemented for all access into the CDE. As of v4.0, MFA required for all interactive logins to the CDE, not just remote access.

Application and system accounts and related authentication factors are managed as follows: accounts with interactive logins disabled, authentication managed by processes and policies.

Procedures to distinguish between onsite personnel and visitors are implemented. Access to sensitive areas within the CDE restricted.

POI devices that capture payment card data are protected from tampering and substitution. Periodic inspections conducted.

Audit logs capture user ID, date/time, type of event, origination, affected component for all security-relevant events.

Audit logs are protected from destruction and unauthorised modifications.

Logs of all system components are reviewed to identify anomalies or suspicious activity. Reviews done at minimum daily for critical systems.

Audit log history is retained for at least 12 months, with at least the most recent three months available for immediate analysis.

Processes and mechanisms for regularly testing security of systems and networks are defined, documented, and understood, including defined roles and responsibilities.

Wireless access points are identified and monitored, and unauthorised wireless access points are addressed.

Internal and external vulnerability scans performed at least quarterly and after significant changes. High and critical vulnerabilities remediated.

External and internal penetration tests performed at least annually, after significant changes. Segmentation testing every 6 months.

Intrusion-detection and/or intrusion-prevention techniques used to detect and/or prevent intrusions into the network.

Comprehensive information security policy covering all PCI DSS requirements established, published, maintained, and communicated to all relevant personnel and applicable vendors.

Targeted risk analyses (TRA) performed for controls with flexible implementation. TRA documents threats, vulnerabilities, countermeasures, and residual risk.

Hardware and software technologies in use are reviewed at least once every 12 months. Processes defined for performing the review.

PCI DSS scope is documented, validated at least annually (and before annual assessment), and shared with the assessor.