PCI DSS 4.0.1 Requirements in Plain English for US Businesses

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• A fixed quote

  A fixed quote follows a free gap assessment, so you know the full cost before you commit.

The outcome. Done-for-you preparation, a submission your acquirer or customer accepts, and engineers who stay on product.

1. Scope. We map your payment flow and design out what can go. 2. Route. We get the acquirer's or customer's instruction in writing; see SAQ versus ROC and SAQ types explained. 3. Free gap assessment. Against version 4.0.1. 4. Close gaps. Long-lead items first: access reviews, logging, vulnerability management, the first penetration test. 5. Evidence and review. Policies that match reality, evidence gathered as you go and an internal review before anyone external looks.

A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required; for SAQ-eligible merchants and service providers we prepare and support the SAQ. You deal with Sterling throughout, backed by 100% success and on-time completion across 8,100+ client engagements in 60+ countries. A fixed quote follows a free gap assessment.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

The outcome. You see which parts of the standard land on your business, and you reach validation quickly, with Sterling doing the heavy lifting.

In the US the request usually comes from one of two places: your acquiring bank or payment processor, under your merchant agreement, or a US enterprise customer whose vendor review includes a payment card line. The PCI Security Standards Council publishes PCI DSS as the baseline of technical and operational requirements for anyone who stores, processes or transmits cardholder data or sensitive authentication data, or who could affect the security of that environment, merchants and service providers included^[1]. The Council does not decide who must validate: payment brands and acquirers do^[1].

The current text is version 4.0.1, a limited revision published in June 2024 that fixes errors and clarifies intent; the Council states that it adds and deletes no requirements^[3]. Version 4.0 was retired on December 31, 2024^[3], and 3.2.1 on March 31, 2024^[8]. Requirements first flagged as best practices became fully required from March 31, 2025^[2]. A checklist written before then is out of date.

The Council describes the standard as twelve principal requirements when it introduces its awareness training^[7]. We group them into six business goals so a US leadership team sees the whole picture on one screen. The grouping and wording are Sterling's own; your assessor works from the numbered text.

The outcome. A smaller scope, which means a shorter questionnaire or a lighter assessment, and less to keep running each year.

The less card data you hold, the less of the standard applies. In plain English, you must know where account data is stored, processed and transmitted; keep it only as long as the business needs it; mask it on screen; make stored card numbers unreadable; and never retain sensitive authentication data, such as the card security code, after authorization. The Council's FAQ library features a question explaining why that last rule holds even when no card numbers are kept^[6].

Version 4.0.1 clarified applicability notes for issuers and the guidance on keyed cryptographic hashes^[3]. For most US software and e-commerce companies the practical move is simpler: design card numbers out of your systems first, and treat everything after that as a bonus.

The outcome. Controls most cloud-first US teams already half-run, written up so they pass.

• Unique accounts. Everyone who touches the environment has a personal login; shared logins are out.
• Least privilege. Access follows the job and is removed when the role ends.
• Multi-factor authentication. Version 4.x extended it to all access into the card data environment, not only administrators^[2]; 4.0.1 added a note that accounts using only phishing-resistant factors are not subject to the extra step for non-administrative access^[3].
• System accounts. Application and system accounts are managed like people, with strong passwords wherever passwords are used^[2].
• Physical access. Whoever can reach a server room or terminal can bypass digital controls.

In practice that means single sign-on, app or hardware authenticators, quarterly access reviews and same-day removal of leavers.

The outcome. A payment page you can defend when a US acquirer or enterprise customer reviews it.

Version 4.0.1 restored earlier wording on patching: the 30-day window applies to critical vulnerabilities^[3]. Other patches follow the risk-based timeline you set.

The headline 4.x change for US online sellers concerns scripts. Merchant sites with an embedded payment page or form need protection against unauthorized script activity, and 4.0.1 added applicability notes to those requirements^[2][3]. Keep a list of every script on the payment page, why it is there and who approved it, plus a way to detect change. Tag managers, analytics snippets and chat widgets cause most surprises.

Custom software needs an inventory, trained developers, code review, secure engineering and controlled changes to production; public-facing web applications need an automated defense against web-based attacks^[2].

The outcome. You spot problems before your acquirer or a customer does.

• Logs. Systems handling card data keep tamper-protected logs with synchronized clocks.
• Review. Version 4.x calls for automated log review for specified events, with a frequency for the rest set by a targeted risk analysis^[2].
• Scans. Internal and external vulnerability scans; an Approved Scanning Vendor runs the external scans where required.
• Penetration tests. Of the environment, and again after significant change.
• Change detection. On critical files and payment pages.

A targeted risk analysis is a documented assessment you use to decide how often certain tasks run. The Council introduced it, along with network security controls, in the move to version 4.0^[5]. It buys flexibility, but the reasoning must be written down.

The outcome. Security that runs on a calendar, not a scramble before each annual renewal.

Plan for a written security policy that staff have read, an accountable owner, an annual risk assessment, awareness training covering phishing and social engineering, and an incident response plan. For the larger questionnaires, the Council lists named personnel available around the clock to respond to suspected or confirmed breaches^[2].

Vendors count too. Keep a list of providers that touch card data or can affect it, a written split of which requirements each one covers and which stay with you, and a check on their status. Version 4.0.1 clarified applicability notes on customer and third-party service provider relationships^[3]. If a provider is still validated to an older version, the Council advises confirming the details with that provider^[8].

Version 4.x added the customized approach beside the defined approach. The defined approach follows each requirement and its testing procedure as written; the customized approach lets a mature organization design its own control against the stated objective, with added documentation and risk analysis^[4]. The Council says the defined approach suits organizations new to PCI DSS because it gives specific direction^[4]. That is where almost every US start-up should begin.

This is Sterling's recommendation, not a requirement of the PCI Security Standards Council.

• Spend the first two weeks shrinking scope, not drafting documents.
• Use the defined approach for your first validation.
• Give each requirement area a named owner and a calendar date for its recurring task.
• File evidence by goal, not by audit date.
• Selling software to businesses that take cards? Read PCI DSS for SaaS next; the PCI DSS hub covers the wider standard.

Want it done for you? Get a proposal after one short call about your payment flow.

PCI DSS is validated in one of two ways, depending on how you handle card data and what your acquirer or card brand requires. A Qualified Security Assessor (QSA) performs the assessment and Report on Compliance where one is required^[1]; for SAQ-eligible merchants and service providers we prepare and support the SAQ.

Either way, you work with Sterling from first scoping call to final submission. We coordinate:

• scoping: where card data is stored, processed or transmitted, and how to shrink that footprint;
• a gap assessment against the current version of the standard;
• the policies, procedures and technical control improvements needed to close the gaps;
• evidence collection and an internal review before anyone external looks at your environment;
• the assessment itself, including scheduling, evidence requests and follow-up questions.

What you receive is a validation of compliance, documented in the form your acquirer or card brand accepts. Our experts bring 30+ years of experience, and Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.

^[1] Become a Qualified Security Assessor (QSA). PCI Security Standards Council. accessed October 23, 2026.

• PCI DSS: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• PCI DSS SAQ Types Explained: Which One Your US Business NeedsUnited States
• PCI DSS SAQ vs ROC: Which Route Your US Business NeedsUnited States
• PCI DSS for US SaaS Companies: Scope, Roles and Buyer RequestsUnited States
• Sterling in the United StatesUnited States

1. PCI Data Security Standard (PCI DSS). PCI Security Standards Council. accessed October 23, 2026.

2. PCI DSS v4: What's New with Self-Assessment Questionnaires. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

3. Just Published: PCI DSS v4.0.1. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

4. PCI DSS v4.0: Is the Customized Approach Right For Your Organization?. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

5. Eight Steps to Take Toward PCI DSS v4.0. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

6. Frequently Asked Questions. PCI Security Standards Council. accessed October 23, 2026.

7. Merchant Resources. PCI Security Standards Council. accessed October 23, 2026.

8. PCI DSS v3.2.1 is Retiring on 31 March 2024 - Are You Ready?. PCI Perspectives Blog, PCI Security Standards Council. accessed October 23, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.