What Is PCI DSS?
PCI DSS (Payment Card Industry Data Security Standard) is a globally recognized framework of security requirements developed to help organizations that process, store, or transmit credit card information maintain a secure environment. Version 4.0 of the standard emphasizes a more flexible, customized approach to achieving and validating security outcomes while continuing to reduce payment data breaches and combat card fraud.
PCI DSS 4.0 covers both technical controls and operational practices, providing a baseline for securing cardholder data environments (CDEs). The standard promotes continuous security, supports evolving technologies, and addresses emerging threats.
The PCI Security Standards Council (PCI SSC) — an independent organization founded by major payment card brands including Visa, MasterCard, American Express, Discover, and JCB — administers and manages the standard. Enforcement and compliance responsibilities remain with each individual payment brand.
PCI DSS 4.0 encourages organizations to integrate security as a continuous process, with a focus on risk-based approaches, including the use of targeted risk analysis to support customized implementation of security controls. The standard provides detailed guidance and resources to help organizations prevent, detect, and respond to security incidents, ultimately supporting the protection of sensitive cardholder information in an ever-changing threat landscape.
What Does PCI DSS 4.0 Cover?
PCI DSS compliance is built on 12 core requirements—each a critical safeguard to protect cardholder data. Meeting these standards within your IT environment demands more than a checklist; it requires a strategic, layered approach to security. Organizations often achieve this through a suite of integrated data protection solutions that work together to defend against evolving threats and ensure continuous compliance.
The 12 PCI DSS 4.0 requirements are bucketed into six categories:
Build and Maintain a Secure Network and Systems
1. Install and maintain network security controls
2. Apply secure configurations to all system components
Protect Account Data
3. Protect stored account data
4. Protect cardholder data with strong cryptography during transmission over open, public networks
Maintain a Vulnerability Management Program
5. Protect all systems and networks from malicious software
6. Develop and maintain secure systems and software
Implement Strong Access Control Measures
7. Restrict access to system components and cardholder data by business need to know
8. Identify users and authenticate access to system components
9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks
10. Log and monitor all access to system components and cardholder data
11. Test security of systems and networks regularly
Maintain an Information Security Policy
12. Support information security with organizational policies and programs
Does PCI DSS Compliance Apply to You?
Any organization – from the mom-and-pop coffee shop to enterprises that span the globe – that accepts, transmits, processes, or stores payment cards or cardholder data needs to adhere to the PCI DSS. There are differences in the level of PCI compliance that is required, depending on an organization’s transaction volume in a given year.
What Are the Different Levels of PCI DSS Compliance?
While ALL organizations that accept, transmit, process, or store cardholder data, are subject to the requirements of PCI DSS, there are four distinct levels of compliance required by individual organizations. These levels are based on transaction volume over a 12-month period:
Level 1:
Level 2:
Level 3:
Level 4:
At the highest compliance level (Level 1), organizations must undergo an external audit conducted by a Qualified Security Assessor (QSA) or an Internal Security Assessor (ISA). This assessment validates the scope of the assessment, reviews documentation, determines whether PCI DSS requirements are being met, and provides guidance for achieving compliance. Upon completion, a Report on Compliance (RoC) is submitted to demonstrate adherence to PCI DSS standards.
Lower compliance level organizations (levels 2 through 4) do not need the external audit but can instead complete a self-assessment questionnaire (SAQ). Level 2 organization also need to complete a RoC.
Maintain a Data Security Policy
Establishing a strong security culture within your organization can enhance PCI DSS 4.0 compliance and overall data security. Organizations should implement regular training programs and ongoing education focused on data security, with particular emphasis on PCI DSS compliance.
Internal data security policy
PCI DSS requirements
Changes to internal systems
PCI compliance responsibilities
Data breaches
The Role of Vulnerability Management in PCI DSS Compliance
To achieve PCI DSS 4.0 compliance, organizations must implement a proactive vulnerability management (VM) program that swiftly identifies and remediates security weaknesses as they emerge. VM impacts multiple core PCI DSS requirements, including safeguarding stored cardholder data and monitoring system access.
The PCI SSC defines a vulnerability as a “flaw or weakness which, if exploited, may result in an intentional or unintentional compromise of a system.” Organizations can stop vulnerabilities from being exploited using automated solutions to scan for common vulnerabilities and exposures (CVEs). Advanced VM solutions continuously scan and prioritize detected CVEs based on risk to help you remediate the most potentially damaging vulnerabilities first. A well-documented VM program also makes passing PCI audits faster and simpler.
PCI and Application Security
Meeting PCI DSS 4.0 requirements for application security requires adherence to best practices and the use of the right tools to verify your solutions. Verification involves enhancing visibility into potential flaws and vulnerabilities in both the code and the endpoints where the application is hosted. It is crucial to use solutions that can accurately detect issues and provide detailed reports that offer evidence for auditors.
With applications, code is the best place to start testing. While manual inspection might allow testers to catch some application problems, it does not scale well for modern software — it is a lengthy process and can have a low accuracy rate.
Current codebases amalgamate numerous external libraries and thousands of lines of code. Automated tools are the only efficient and effective way to test the code and its implementation. Using code analysis tools such as software composition analysis (SCA), static application security testing (SAST), and dynamic application security testing (DAST), testers can identify security vulnerabilities, design defects, logical errors, and implementation flaws, as PCI DSS requires.
Take the next step in PCI security
Technology never stops evolving. New and different attack combinations are continually being attempted. Learn more about our Dynamic Application Security Testing Software.
Fortra is a PCI Approved Scanning Vendor
PCI DSS 4.0 Compliance Solutions
Complying with PCI DSS requirements is easier with layers of security solutions that can be put in place across your organization to protect sensitive cardholder data. Fortra's security suite offers a range of solutions designed to help you meet your PCI DSS obligations and protect the data of your cardholders.
Fortra and PCI DSS
Fortra’s portfolio of cybersecurity and compliance offerings provide a wide range of solutions and services to help businesses comply with the PCI DSS 4.0 requirements and fulfill the daily demands of protecting the company from risks and threats. The following table maps PCI DSS 4.0 requirements to Fortra’s solutions.
Requirement 1: Install and maintain network security controls
Requirement 2: Apply secure configurations
Requirement 3: Protect stored account data
Requirement 4: Protect cardholder data with strong cryptography during transmission over open, public networks
Requirement 5: Protect systems and networks from malicious software
Requirement 6: Develop and maintain secure systems and software
Requirement 7: Restrict access to system components and cardholder data
Requirement 8: Identify users and authenticate access
Requirement 9: Restrict physical access
Requirement 10: Log and monitor all access
Requirement 11: Test security of systems and networks regularly
Requirement 12: Support information security with policies and programs
We Can Help with PCI DSS 4.0 Compliance. Let’s Talk.
Contact the experts at Fortra for a free 30-minute consultation to explore the best solutions for securing cardholder data in your organization. We’ll work with you to identify the right layers of protection to ensure PCI DSS compliance.