PCI DSS 4.0.1: All 12 Requirements Explained with Implementation Costs
PCI DSS 4.0.1 is the current version of the Payment Card Industry Data Security Standard. Version 3.2.1 was retired in March 2024, and 51 future-dated requirements became mandatory on 31 March 2025. This page covers every requirement with plain-English explanations, implementation costs, difficulty ratings, 4.0-specific changes, and common audit failure points.
Requirements
12
Goals
6
New in 4.0
64 requirements
Total Implementation
$32K - $475K
PCI DSS 4.0.1 Timeline
March 2022
PCI DSS v4.0 released
March 2024
PCI DSS v3.2.1 retired. v4.0 becomes the only active version
June 2024
PCI DSS v4.0.1 released (minor clarifications to v4.0)
31 March 2025
51 future-dated requirements become mandatory
April 2026
All requirements fully enforced. Assessments must use v4.0.1
The Six Goals of PCI DSS
The 12 PCI DSS requirements are organised under six high-level goals. Understanding the goals helps you see the logical structure of the standard: it moves from building a secure foundation (network and data protection) through operational controls (vulnerability management, access control, monitoring) to governance (policies and programmes).
Goal 1
Build and Maintain a Secure Network and Systems
Goal 2
Protect Account Data
Goal 3
Maintain a Vulnerability Management Program
Goal 4
Implement Strong Access Control Measures
Goal 5
Regularly Monitor and Test Networks
Goal 6
Maintain an Information Security Policy
All 12 Requirements in Detail
Requirement 1 | Build and Maintain a Secure Network and Systems
Install and Maintain Network Security Controls
Establish and maintain firewalls, routers, and other network security controls that protect the cardholder data environment. This includes documenting network topology, restricting inbound and outbound traffic, and reviewing firewall rules at least every six months.
What Changed in PCI DSS 4.0
Expanded to cover all network security controls (not just firewalls). Renamed from 'Install and maintain a firewall configuration' to reflect modern architectures including cloud, containers, and software-defined networking.
Common Audit Failure Points
- Overly permissive firewall rules not reviewed in 6+ months
- Missing documentation of network topology and data flows
- No formal change management process for firewall rule modifications
- Failure to restrict outbound traffic from the CDE
Relevant Tools and Cost Ranges
Next-gen firewalls ($2,000-$15,000), cloud security groups (included with cloud providers), network documentation tools ($500-$2,000)
Requirement 2 | Build and Maintain a Secure Network and Systems
Apply Secure Configurations to All System Components
Remove vendor-supplied default passwords, disable unnecessary services, and apply hardened configurations to all systems in scope. Maintain configuration standards for every type of system component in the CDE.
What Changed in PCI DSS 4.0
Renamed from 'Do not use vendor-supplied defaults.' Now requires managing all security parameters, not just defaults. Includes cloud and containerised environments explicitly.
Common Audit Failure Points
- Default credentials still active on network devices or databases
- Unnecessary services and protocols left enabled
- Missing hardening standards for cloud infrastructure
- Inconsistent configurations across environments
Relevant Tools and Cost Ranges
Configuration management tools (Ansible, Chef, Puppet - $0-$10,000/year), CIS Benchmark tools ($500-$5,000)
Requirement 3 | Protect Account Data
Protect Stored Account Data
Minimise cardholder data storage and protect what must be stored using encryption, truncation, masking, or hashing. Never store sensitive authentication data (full track, CVV, PIN) after authorisation.
What Changed in PCI DSS 4.0
Expanded scope to 'account data' (not just cardholder data). New requirements for SAD storage detection and cryptographic key management. Disk-level encryption alone is no longer sufficient for removable media.
Common Audit Failure Points
- Storing full PAN in plaintext in databases or log files
- Retaining cardholder data beyond the authorised retention period
- Inadequate encryption key management procedures
- Unencrypted backup tapes or removable media containing card data
Relevant Tools and Cost Ranges
Encryption solutions ($5,000-$50,000), tokenisation platforms ($0-$10,000/year), DLP tools ($3,000-$20,000/year)
Requirement 4 | Protect Account Data
Protect Cardholder Data with Strong Cryptography During Transmission
Encrypt cardholder data during transmission over open, public networks using strong cryptography. This includes internet transactions, wireless networks, and any untrusted network segments.
What Changed in PCI DSS 4.0
Updated cipher suite requirements. TLS 1.0 and 1.1 are explicitly prohibited. Certificates must be validated and current. Applies to all transmission of PAN, not just over the internet.
Common Audit Failure Points
- Using outdated TLS versions (1.0 or 1.1) on internal systems
- Expired or self-signed SSL/TLS certificates in production
- Sending PAN via email, chat, or other unencrypted channels
- Missing encryption on internal network segments carrying card data
Relevant Tools and Cost Ranges
SSL/TLS certificates ($0-$500/year), certificate management tools ($1,000-$5,000), network encryption solutions ($2,000-$10,000)
Requirement 5 | Maintain a Vulnerability Management Program
Protect All Systems and Networks from Malicious Software
Deploy anti-malware solutions on all systems commonly affected by malware. Keep solutions current, perform periodic scans, and generate audit logs. Address evolving malware threats including ransomware and fileless attacks.
What Changed in PCI DSS 4.0
Renamed from 'Protect all systems against malware.' Now requires addressing all types of malicious software, including on systems not traditionally considered at risk. Anti-phishing mechanisms now required under Requirement 5.4.
Common Audit Failure Points
- Anti-malware not deployed on all in-scope systems (including Linux servers)
- Outdated signature definitions or disabled real-time scanning
- No anti-phishing controls for email and web browsing
- Missing malware protection on removable media
Relevant Tools and Cost Ranges
EDR solutions ($3,000-$30,000/year), anti-phishing tools ($1,000-$5,000/year), email security gateways ($2,000-$10,000/year)
Requirement 6 | Maintain a Vulnerability Management Program
Develop and Maintain Secure Systems and Software
Develop software securely, protect against known vulnerabilities by installing security patches promptly, and deploy web application firewalls or equivalent controls for public-facing web applications.
What Changed in PCI DSS 4.0
Major new requirement 6.4.3: manage all payment page scripts loaded and executed in the consumer browser. This targets Magecart-style attacks and requires inventory, authorisation, and integrity verification of all scripts on payment pages.
Common Audit Failure Points
- Critical security patches not applied within 30 days
- No inventory or authorisation process for payment page scripts (6.4.3)
- Missing WAF or equivalent for public-facing web applications
- Inadequate secure code review or SAST/DAST processes
Relevant Tools and Cost Ranges
WAF ($3,000-$30,000/year), SAST/DAST tools ($5,000-$40,000/year), payment page script monitoring ($3,000-$10,000/year), patch management ($2,000-$15,000/year)
Requirement 7 | Implement Strong Access Control Measures
Restrict Access to System Components and Cardholder Data by Business Need to Know
Limit access to cardholder data and system components to only those individuals whose job requires it. Implement role-based access control (RBAC) and review access rights at least every six months.
What Changed in PCI DSS 4.0
Explicit requirement for application and system accounts (not just user accounts). Access reviews must cover all accounts with access to the CDE, including service and application accounts.
Common Audit Failure Points
- Excessive access privileges not aligned with job roles
- No formal access review process or reviews not completed semi-annually
- Shared or generic accounts used for CDE access
- Service accounts with overly broad permissions
Relevant Tools and Cost Ranges
IAM solutions ($2,000-$20,000/year), privileged access management ($5,000-$30,000/year), access review tools ($1,000-$10,000/year)
Requirement 8 | Implement Strong Access Control Measures
Identify Users and Authenticate Access to System Components
Assign unique IDs to all users, implement strong authentication, and deploy multi-factor authentication (MFA) for all access to the cardholder data environment. PCI DSS 4.0 expands MFA requirements significantly.
What Changed in PCI DSS 4.0
MFA now required for ALL access into the CDE (not just remote access). Minimum password length increased to 12 characters. Password complexity and rotation requirements updated. System and application accounts must be managed with the same rigour as user accounts.
Common Audit Failure Points
- MFA not implemented for all CDE access (only remote access covered)
- Passwords under 12 characters or lacking complexity requirements
- Shared credentials for administrative access
- No mechanism to detect and prevent use of compromised passwords
Relevant Tools and Cost Ranges
MFA solutions ($2,000-$20,000/year), password managers ($500-$5,000/year), SSO platforms ($3,000-$15,000/year)
Requirement 9 | Implement Strong Access Control Measures
Restrict Physical Access to Cardholder Data
Implement physical access controls for facilities housing systems that store, process, or transmit cardholder data. This includes badge access, visitor logs, media controls, and POS terminal tamper checks.
What Changed in PCI DSS 4.0
New requirement for periodic POS terminal inspections to detect tampering. Updated media destruction requirements. Explicit requirements for protecting network jacks and wireless access points.
Common Audit Failure Points
- No formal POS terminal inspection programme for tamper detection
- Visitor access logs incomplete or not retained for required period
- Inadequate media destruction procedures and documentation
- Server rooms accessible without individual authentication
Relevant Tools and Cost Ranges
Physical access control systems ($5,000-$50,000), surveillance cameras ($2,000-$20,000), media destruction services ($500-$2,000/year)
Requirement 10 | Regularly Monitor and Test Networks
Log and Monitor All Access to System Components and Cardholder Data
Implement logging mechanisms to track all user access to cardholder data and system components. Review logs daily (automated tools acceptable). Retain audit logs for at least 12 months with 3 months immediately available.
What Changed in PCI DSS 4.0
Automated log review mechanisms now required (manual-only review no longer sufficient). New requirements for detecting and alerting on failures of critical security control systems. This effectively mandates SIEM or equivalent technology.
Common Audit Failure Points
- No automated log review mechanism (relying on manual review only)
- Logs not retained for the full 12-month period
- Missing or incomplete logging on critical CDE systems
- No alerting mechanism for security control failures
Relevant Tools and Cost Ranges
SIEM platforms ($5,000-$100,000/year), log management tools ($2,000-$30,000/year), managed SIEM services ($3,000-$50,000/year)
Requirement 11 | Regularly Monitor and Test Networks
Test Security of Systems and Networks Regularly
Conduct regular security testing including quarterly ASV vulnerability scans, annual penetration tests, wireless analyser scans, and change-detection mechanisms (file integrity monitoring).
What Changed in PCI DSS 4.0
Internal vulnerability scans must be authenticated. Penetration testing methodology must cover the entire CDE perimeter and critical systems. If network segmentation is used, segmentation controls must be tested at least every 6 months.
Common Audit Failure Points
- Quarterly ASV scans failing and not being remediated and rescanned
- Penetration testing scope not covering the full CDE perimeter
- No segmentation testing when network segmentation is used for scope reduction
- File integrity monitoring not covering all critical system files
Relevant Tools and Cost Ranges
ASV scanning ($400-$2,000/year), penetration testing ($5,000-$50,000/year), FIM tools ($2,000-$15,000/year), wireless scanning ($500-$5,000)
Requirement 12 | Maintain an Information Security Policy
Support Information Security with Organisational Policies and Programmes
Maintain a comprehensive information security policy that addresses all PCI DSS requirements. Implement security awareness training, incident response plans, and risk assessment processes. Ensure service providers are managed and monitored.
What Changed in PCI DSS 4.0
New requirement for targeted risk analysis (TRA) to support flexible implementation. Security awareness training must include phishing and social engineering. Incident response plan must be tested annually. Expanded third-party/service provider management requirements.
Common Audit Failure Points
- Security policies not reviewed and updated annually
- Security awareness training not including phishing simulations
- Incident response plan never tested or exercised
- Third-party service providers not monitored for PCI compliance status
Relevant Tools and Cost Ranges
Policy management tools ($500-$5,000/year), security awareness platforms ($1,000-$5,000/year), GRC platforms ($5,000-$30,000/year)
Summary: All Requirements at a Glance
| # | Requirement | Cost Range | Difficulty |
|---|---|---|---|
| 1 | Install and Maintain Network Security Controls | $2,000 - $25,000 | Medium |
| 2 | Apply Secure Configurations to All System Components | $1,000 - $15,000 | Medium |
| 3 | Protect Stored Account Data | $5,000 - $50,000 | High |
| 4 | Protect Cardholder Data with Strong Cryptography During Transmission | $1,000 - $10,000 | Low |
| 5 | Protect All Systems and Networks from Malicious Software | $2,000 - $30,000/year | Medium |
| 6 | Develop and Maintain Secure Systems and Software | $5,000 - $75,000 | High |
| 7 | Restrict Access to System Components and Cardholder Data by Business Need to Know | $1,000 - $20,000 | Medium |
| 8 | Identify Users and Authenticate Access to System Components | $2,000 - $25,000 | High |
| 9 | Restrict Physical Access to Cardholder Data | $2,000 - $50,000 | Medium |
| 10 | Log and Monitor All Access to System Components and Cardholder Data | $5,000 - $100,000/year | High |
| 11 | Test Security of Systems and Networks Regularly | $5,000 - $60,000/year | High |
| 12 | Support Information Security with Organisational Policies and Programmes | $1,000 - $15,000 | Medium |
| Total Implementation Cost | $32,000 - $475,000 | ||