PCI DSS requirements explained: video brief

Twelve requirements under six goals

PCI DSS v4.0.1 sets twelve requirements under six goals, in the standard's own words: Build and Maintain a Secure Network and Systems (requirements 1 and 2), Protect Account Data (3 and 4), Maintain a Vulnerability Management Program (5 and 6), Implement Strong Access Control Measures (7, 8 and 9), Regularly Monitor and Test Networks (10 and 11) and Maintain an Information Security Policy (12). This short film walks through that map.

Each requirement breaks down into numbered sub-requirements with the testing procedures the assessor follows. Requirement 1 controls traffic between trusted and untrusted networks and into the cardholder data environment, evidenced by network and data-flow diagrams and rulesets with a justification per rule. Requirement 2 hardens every system in scope and removes vendor defaults. Requirement 3 asks you to keep only the account data you need, never store sensitive authentication data after authorisation and render stored primary account numbers unreadable, and requirement 4 protects them with strong cryptography in transit over open, public networks.

Every requirement applies throughout the cardholder data environment, so knowing exactly where card data enters, moves and leaves comes before any control.

Defined approach, customised approach and validation

Every requirement can be met by the defined approach or, where you can justify an alternative control, by a customised approach that meets the requirement's stated objective. The remaining goals cover protection from malicious software and secure systems and software, access restricted by business need with strong authentication, physical access, logging and monitoring, regular security testing and an information security policy that the organisation actually runs.

Compliance is validated at least once a year: a Qualified Security Assessor's Report on Compliance and Attestation of Compliance for larger merchants and most service providers, or a self-assessment questionnaire where the acquirer and the card brands allow it, with quarterly scans by an Approved Scanning Vendor where they apply. PCI DSS v4.0.1, published on 11 June 2024, is the only active version.