Payment Card Industry

Data Security Standard

Requirements and Testing Procedures
Version 4.0
March 2022

Document Changes
Date

VersionDescription

October 2008

1.2

To introduce PCI DSS v1.2 as “PCI DSS Requirements and Security Assessment Procedures,” eliminating
redundancy between documents, and making both general and specific changes from PCI DSS Security Audit
Procedures v1.1. For complete information, see PCI Data Security Standard Summary of Changes from PCI DSS
Version 1.1 to 1.2.

July 2009

1.2.1

Add sentence that was incorrectly deleted between PCI DSS v1.1 and v1.2.
Correct “then” to “than” in testing procedures 6.3.7.a and 6.3.7.b.
Remove grayed-out marking for “in place” and “not in place” columns in testing procedure 6.5.b.
For Compensating Controls Worksheet – Completed Example, correct wording at top of page to say, “Use thisworksheet to define compensating controls for any requirement noted as “in place” via compensating controls.”

October 2010

2.0

Update and implemented changes from v1.2.1. See PCI DSS – Summary of Changes from PCI DSS Version 1.2.1 to
2.0.

November 2013

3.0

Update from v2.0. See PCI DSS – Summary of Changes from PCI DSS Version 2.0 to 3.0.

April 2015

3.1

Update from PCI DSS v3.0. See PCI DSS – Summary of Changes from PCI DSS Version 3.0 to 3.1 for details ofchanges.

April 2016

3.2

Update from PCI DSS v3.1. See PCI DSS – Summary of Changes from PCI DSS Version 3.1 to 3.2 for details ofchanges.

May 2018

3.2.1

Update from PCI DSS v3.2. See PCI DSS – Summary of Changes from PCI DSS Version 3.2 to 3.2.1 for details ofchanges.

March 2022

4.0

Rename document title to “Payment Card Industry Data Security Standard: Requirements and Testing Procedures.”Update from PCI DSS v3.2.1. See PCI DSS – Summary of Changes from PCI DSS Version 3.2.1 to 4.0 for details ofchanges.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
©2006 - 2022 PCI Security Standards Council, LLC. All Rights Reserved.

March 2022
Page ii

Table of Contents
1

Introduction and PCI Data Security Standard Overview ................................................................................................................................... 1

2

PCI DSS Applicability Information ....................................................................................................................................................................... 4

3

Relationship between PCI DSS and PCI SSC Software Standards .................................................................................................................. 7

4

Scope of PCI DSS Requirements ......................................................................................................................................................................... 95Best Practices for Implementing PCI DSS into Business-as-Usual Processes ............................................................................................ 19

6

For Assessors: Sampling for PCI DSS Assessments...................................................................................................................................... 22

7

Description of Timeframes Used in PCI DSS Requirements .......................................................................................................................... 25

8

Approaches for Implementing and Validating PCI DSS .................................................................................................................................. 28

9

Protecting Information About an Entity’s Security Posture ........................................................................................................................... 31

10 Testing Methods for PCI DSS Requirements .................................................................................................................................................... 32
11 Instructions and Content for Report on Compliance....................................................................................................................................... 33
12 PCI DSS Assessment Process ........................................................................................................................................................................... 34
13 Additional References ......................................................................................................................................................................................... 35
14 PCI DSS Versions ................................................................................................................................................................................................ 36
15 Detailed PCI DSS Requirements and Testing Procedures .............................................................................................................................. 37
Build and Maintain a Secure Network and Systems ............................................................................................................................................. 39
Protect Account Data ............................................................................................................................................................................................. 73
Maintain a Vulnerability Management Program .................................................................................................................................................. 111
Implement Strong Access Control Measures ...................................................................................................................................................... 149

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page iii

Regularly Monitor and Test Networks ................................................................................................................................................................. 212
Maintain an Information Security Policy .............................................................................................................................................................. 259
Appendix A

Additional PCI DSS Requirements ............................................................................................................................................. 298

Appendix A1: Additional PCI DSS Requirements for Multi-Tenant Service Providers ........................................................................................ 298
Appendix A2: Additional PCI DSS Requirements for Entities Using SSL/Early TLS for Card-Present POS POI Terminal Connections .......... 304
Appendix A3: Designated Entities Supplemental Validation (DESV) .................................................................................................................. 308
Appendix B

Compensating Controls ............................................................................................................................................................... 330

Appendix C

Compensating Controls Worksheet ........................................................................................................................................... 332

Appendix D

Customized Approach ................................................................................................................................................................. 333

Appendix E

Sample Templates to Support Customized Approach ............................................................................................................. 335

Appendix F

Leveraging the PCI Software Security Framework to Support Requirement 6 ..................................................................... 341

Appendix G

PCI DSS Glossary of Terms, Abbreviations, and Acronyms ................................................................................................... 344

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page iv

1

Introduction and PCI Data Security Standard Overview
The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance payment card account data security
and facilitate the broad adoption of consistent data security measures globally. PCI DSS provides a baseline of technical and operational
requirements designed to protect account data. While specifically designed to focus on environments with payment card account data, PCI
DSS can also be used to protect against threats and secure other elements in the payment ecosystem.
Table 1 shows the 12 principal PCI DSS requirements.

Table 1. Principal PCI DSS Requirements
PCI Data Security Standard – High Level Overview
Build and Maintain a Secure Network and Systems

1.
2.

Install and Maintain Network Security Controls.
Apply Secure Configurations to All System Components.

Protect Account Data

3.
4.

Protect Stored Account Data.
Protect Cardholder Data with Strong Cryptography During
Transmission Over Open, Public Networks.

Maintain a Vulnerability Management Program

5.
6.

Protect All Systems and Networks from Malicious Software.
Develop and Maintain Secure Systems and Software.

Implement Strong Access Control Measures

7.

Restrict Access to System Components and Cardholder Data by
Business Need to Know.
Identify Users and Authenticate Access to System Components.
Restrict Physical Access to Cardholder Data.

8.
9.
Regularly Monitor and Test Networks

10. Log and Monitor All Access to System Components and Cardholder
Data.
11. Test Security of Systems and Networks Regularly.

Maintain an Information Security Policy

12. Support Information Security with Organizational Policies andPrograms.

This document, the Payment Card Industry Data Security Standard Requirements and Testing Procedures, consists of the 12 PCI DSS
principal requirements, detailed security requirements, corresponding testing procedures, and other information pertinent to each requirement.
The following sections provide detailed guidelines and best practices to assist entities to prepare for, conduct, and report the results of a PCI
DSS assessment. The PCI DSS requirements and testing procedures begin on page 43.
Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 1PCI DSS comprises a minimum set of requirements for protecting account data and may be enhanced by additional controls and practices tofurther mitigate risks, and to incorporate local, regional, and sector laws and regulations. Additionally, legislation or regulatory requirements
may require specific protection of personal information or other data elements (for example, cardholder name).

Limitations
If any of the requirements contained in this standard conflict with country, state, or local laws, the country, state, or local law will apply.

PCI DSS Resources
The PCI Security Standards Council (PCI SSC) website (www.pcisecuritystandards.org) provides the following additional resources to assist
organizations with their PCI DSS assessments and validations:Document Library, including:–

PCI DSS Summary of Changes–

PCI DSS Quick Reference Guide–

Information Supplements and Guidelines–

Prioritized Approach for PCI DSS–

Report on Compliance (ROC) Reporting Template and Reporting Instructions–

Self-Assessment Questionnaires (SAQs) and SAQ Instructions and Guidelines–

Attestations of Compliance (AOCs)

Frequently Asked Questions (FAQs)



PCI for Small Merchants website



PCI training courses and informational webinars



List of Qualified Security Assessors (QSAs) and Approved Scanning Vendors (ASVs)



Lists of PCI approved devices, applications, and solutions

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 2

There are over 60 guidance documents and information supplements available on the PCI SSC website that provide specific guidance andconsiderations for PCI DSS. Examples include:Guidance for PCI DSS Scoping and Network Segmentation

PCI SSC Cloud Computing GuidelinesMulti-Factor Authentication GuidanceThird-Party Security Assurance

Effective Daily Log Monitoring

Penetration Testing GuidanceBest Practices for Implementing a Security Awareness ProgramBest Practices for Maintaining PCI DSS Compliance

PCI DSS for Large Organizations



Use of SSL/Early TLS and Impact on ASV Scans

Use of SSL/Early TLS for POS POI Terminal Connections

Tokenization Product Security GuidelinesProtecting Telephone-Based Payment Card Data

Note: Information Supplementscomplement PCI DSS and identify
additional considerations andrecommendations for meeting PCI
DSS requirements. Information
Supplements do not supersede,replace, or extend PCI DSS or anyof its requirements.

Refer to the Document Library at www.pcisecuritystandards.org for information about these and other resources.
In addition, refer to Appendix G for definitions of PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 3

2

PCI DSS Applicability Information
PCI DSS is intended for all entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD) or could
impact the security of the cardholder data environment (CDE). This includes all entities involved in payment card account processing —including merchants, processors, acquirers, issuers, and other service providers.
Whether any entity is required to comply with or validate their compliance to PCI DSS is at the discretion of those organizations that manage
compliance programs (such as payment brands and acquirers). Contact the organizations of interest for any additional criteria.

Defining Account Data, Cardholder Data, and Sensitive Authentication Data
Cardholder data and sensitive authentication data are considered account data and are defined as follows:

Table 2. Account Data
Account Data
Cardholder Data includes:

Sensitive Authentication Data includes:•

Primary Account Number (PAN)•

Full track data (magnetic-stripe data or equivalent on a chip)•

Cardholder Name•

Card verification code•

Expiration Date•

PINs/PIN blocks•

Service CodePCI DSS requirements apply to entities with environments where account data (cardholder data and/or sensitive authentication data) is stored,
processed, or transmitted, and entities with environments that can impact the security of the CDE. Some PCI DSS requirements may also
apply to entities with environments that do not store, process, or transmit account data – for example, entities that outsource payment
operations or management of their CDE 1. Entities that outsource their payment environments or payment operations to third parties remain
responsible for ensuring that the account data is protected by the third party per applicable PCI DSS requirements.
The primary account number (PAN) is the defining factor for cardholder data. The term account data therefore covers the following: the full
PAN, any other elements of cardholder data that are present with the PAN, and any elements of sensitive authentication data.

1 In accordance with those organizations that manage compliance programs (such as payment brands and acquirers); entities should contact the organizations ofinterest for more details.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 4

If cardholder name, service code, and/or expiration date are stored, processed, or transmitted with the PAN, or are otherwise present in the
CDE, they must be protected in accordance with the PCI DSS requirements applicable to cardholder data.
If an entity stores, processes, or transmits PAN, then a CDE exists to which PCI DSS requirements will apply. Some requirements may not beapplicable, for example if the entity does not store PAN, then the requirements relating to the protection of stored PAN in Requirement 3 will
not be applicable to the entity.
Even if an entity does not store, process, or transmit PAN, some PCI DSS requirements may still apply. Consider the following:

If the entity stores SAD, requirements specifically related to SAD storage in Requirement 3 will be applicable.



If the entity engages third-party service providers to store, process or transmit PAN on its behalf, requirements related to the
management of service providers in Requirement 12 will be applicable.



If the entity can impact the security of a CDE because the security of an entity’s infrastructure can affect how cardholder data isprocessed (for example, via a web server that controls the generation of a payment form or page) some requirements will be applicable.



If cardholder data is only present on physical media (for example paper), requirements relating to the security and disposal of physicalmedia in Requirement 9 will be applicable.

Requirements related to an incident response plan are applicable to all entities, to ensure that there are procedures to follow in theevent of a suspected or actual breach of the confidentiality of cardholder data.

Use of Account Data, Sensitive Authentication Data, Cardholder Data, and Primary Account Number in PCI DSSPCI DSS includes requirements that specifically refer to account data, cardholder data, and sensitive authentication data. It is important
to note that each of these types of data are different and the terms are not interchangeable. Specific references within requirements toaccount data, cardholder data, or sensitive authentication data are purposeful, and the requirements apply specifically to the type ofdata that is referenced.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 5

Elements of Account Data and Storage Requirements
Table 3 identifies the elements of cardholder and sensitive authentication data, whether storage of each data element is permitted or
prohibited, and whether each data element must be rendered unreadable—for example, with strong cryptography—when stored. This
table is not exhaustive and is presented to illustrate only how the stated requirements apply to the different data elements.

Table 3. Account Data Element Storage Requirements

Account Data

Cardholder
Data

Data Elements

Storage Restrictions

Required to Render Stored Data
Unreadable

Primary Account Number (PAN)

Storage is kept to a minimum as defined in
Requirement 3.2

Yes, as defined in Requirement 3.5

Storage is kept to a minimum as defined in
Requirement 3.2 2

No

Cannot be stored after authorization as
defined in Requirement 3.3.1 3

Yes, data stored until authorization iscomplete must be protected with strong
cryptography as defined in Requirement
3.3.2

Cardholder Name
Service CodeExpiration Date

Sensitive
Authentication
Data

Full Track Data
Card verification code
PIN/PIN Block

If PAN is stored with other elements of cardholder data, only the PAN must be rendered unreadable according to PCI DSS Requirement 3.5.1.
Sensitive authentication data must not be stored after authorization, even if encrypted. This applies even for environments where there is no
PAN present.

2 Where data exists in the same environment as PAN.

3 Except as permitted for issuers and companies that support issuing services. Requirements for issuers and issuing services are separately defined in
Requirement 3.3.3.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 6

3

Relationship between PCI DSS and PCI SSC Software Standards
PCI SSC supports the use of secure payment software within cardholder data environments (CDE) via the Payment Application Data Security
Standard (PA-DSS) and the Software Security Framework (SSF), which consists of the Secure Software Standard and the Secure Software
Lifecycle (Secure SLC) Standard. Software that is PCI SSC validated and listed provides assurance that the software has been developed
using secure practices and has met a defined set of software security requirements.
The PCI SSC secure software programs include listings of payment software and software
vendors that have been validated as meeting the applicable PCI SSC Software Standards.
Validated Software: Payment software listed on the PCI SSC website as a
Validated Payment Application (PA-DSS) or Validated Payment Software (theSecure Software Standard) has been evaluated by a qualified assessor to confirm
the software meets the security requirements within that standard. The security
requirements in these standards are focused on protecting the integrity andconfidentiality of payment transactions and account data.

Validated Software Vendors: The Secure SLC Standard defines security
requirements for software vendors to integrate secure software development
practices throughout the entire software lifecycle. Software vendors that have beenvalidated as meeting the Secure SLC Standard are listed on the PCI SSC website
as a Secure SLC Qualified Vendor.

Note: PA-DSS and the related program will beretired in October 2022. Refer to the PCI SSC
List of Validated Payment Applications for
expiry dates for PA-DSS validated
applications. After the expiry date, applications
are listed as “Acceptable only for Pre-Existing
Deployments.” Whether an entity can continue
to use a PA-DSS application with an expired
listing is at the discretion of organizations thatmanage compliance programs (such as
payment brands and acquirers); entities should
contact the organizations of interest for moredetails.

For more information about the SSF or PA-DSS, refer to the respective Program Guides at www.pcisecuritystandards.org.
All software that stores, processes, or transmits account data, or that could impact the security of account data or a CDE, is in scope for anentity’s PCI DSS assessment. While the use of validated payment software supports the security of an entity’s CDE, the use of such software
does not by itself make an entity PCI DSS compliant. The entity’s PCI DSS assessment should include verification that the software is properly
configured and securely implemented to support applicable PCI DSS requirements. Additionally, if PCI-listed payment software has beencustomized, a more in-depth review will be required during the PCI DSS assessment because the software may no longer be representative of
the version that was originally validated.
Because security threats are constantly evolving, software that is no longer supported by the vendor (for example, identified by the vendor as“end of life”) may not offer the same level of security as supported versions. Entities are strongly encouraged to keep their software current
and updated to the latest software versions available.
Entities that develop their own software are encouraged to refer to PCI SSC’s software security standards and consider the requirements
therein as best practices to use in their development environments. Secure payment software implemented in a PCI DSS compliant
environment will help minimize the potential for security breaches leading to compromises of account data and fraud. See Bespoke andCustom Software.
Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 7

Applicability of PCI DSS to Payment Software Vendors
PCI DSS may apply to a payment software vendor if the vendor is also a service provider that stores, processes, or transmits accountdata, or has access to their customers’ account data—for example, in the role of a payment service provider or via remote access to acustomer environment. Software vendors to which PCI DSS may be applicable include those offering payment services, as well as cloudservice providers offering payment terminals in the cloud, software as a service (SaaS), e-commerce in the cloud, and other cloud
payment services.

Bespoke and Custom Software
All bespoke and custom software that stores, processes, or transmits
account data, or that could impact the security of account data or a CDE,
is in scope for an entity’s PCI DSS assessment.
Bespoke and custom software that has been developed and maintainedin accordance with one of PCI SSC’s Software Security Framework
standards (the Secure Software Standard or the Secure SLC standard)
will support an entity in meeting PCI DSS Requirement 6.

Note: PCI DSS Requirement 6 fully applies to bespokeand custom software that has not been developed andmaintained in accordance with one of PCI SSC’s Software
Security Framework standards. Entities that use software
vendors to develop bespoke or custom software that
could impact the security of account data or their CDE are
responsible for ensuring those software vendors develop
the software according to PCI DSS Requirement 6.

See Appendix F for more details.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 8

4

Scope of PCI DSS Requirements
PCI DSS requirements apply to:

The cardholder data environment (CDE), which is comprised of:–

System components, people, and processes that store, process, and transmit cardholder data and/or sensitive authentication data,
and,–

System components that may not store, process, or transmit CHD/SAD but have unrestricted connectivity to system componentsthat store, process, or transmit CHD/SAD.

AND

System components, people, and processes that could impact the security of the CDE. 4“System components” include network devices, servers, computing devices, virtual components, cloud components, and software. Examplesof system components include but are not limited to:Systems that store, process, or transmit account data (for example, payment terminals, authorization systems, clearing systems,
payment middleware systems, payment back-office systems, shopping cart and store front systems, payment gateway/switch systems,
fraud monitoring systems).

Systems that provide security services (for example, authentication servers, access control servers, security information and event
management (SIEM) systems, physical security systems (for example, badge access or CCTV), multi-factor authentication systems,
anti-malware systems).

Systems that facilitate segmentation (for example, internal network security controls).

Systems that could impact the security of account data or the CDE (for example, name resolution, or e-commerce (web) redirection
servers).



Virtualization components such as virtual machines, virtual switches/routers, virtual appliances, virtual applications/desktops, andhypervisors.

Cloud infrastructure and components, both external and on premises, and including instantiations of containers or images, virtual private
clouds, cloud-based identity and access management, CDEs residing on premises or in the cloud, service meshes with containerized
applications, and container orchestration tools.

4 For additional guidance, refer to Information Supplement: Guidance for PCI DSS Scoping and Network Segmentation on the PCI SSC website.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 9

Network components, including but not limited to network security controls, switches, routers, VoIP network devices, wireless accesspoints, network appliances, and other security appliances.



Server types, including but not limited to web, application, database, authentication, mail, proxy, Network Time Protocol (NTP), andDomain Name System (DNS).



End-user devices, such as computers, laptops, workstations, administrative workstations, tablets, and mobile devices.



Printers, and multi-function devices that scan, print, and fax.

Storage of account data in any format (for example, paper, data files, audio files, images, and video recordings).

Applications, software, and software components, serverless applications, including all purchased, subscribed (for example, Softwareas-a-Service), bespoke and custom software, including internal and external (for example, Internet) applications.



Tools, code repositories, and systems that implement software configuration management or for deployment of objects to the CDE or tosystems that can impact the CDE.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 10Figure 1 shows considerations for scoping system components for PCI DSS.

Figure 1. Understanding PCI DSS Scoping

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 11

Annual PCI DSS Scope Confirmation
The first step in preparing for a PCI DSS assessment is for the entity to accurately determine the scope of the review. The assessed entity
must confirm the accuracy of their PCI DSS scope according to PCI DSS Requirement 12.5.2 by identifying all locations and flows of accountdata, and identifying all systems that are connected to or, if compromised, could impact the CDE (for example, authentication servers, remote
access servers, logging servers) to ensure they are included in the PCI DSS scope. All types of systems and locations should be consideredduring the scoping process, including backup/recovery sites and fail-over systems.
The minimum steps for an entity to confirm the accuracy of their PCI DSS scope are specified in PCI DSS Requirement 12.5.2. The entity is
expected to retain documentation to show how PCI DSS scope was determined. The documentation is retained for assessor review and forreference during the entity’s next PCI DSS scope confirmation activity. For each PCI DSS assessment, the assessor validates that the entity
accurately defined and documented the scope of the assessment.
Note: This annual confirmation of PCI DSS scope is defined at PCI DSS Requirement at 12.5.2 and is an activity expected to be performed by
the entity. This activity is not the same, nor is it intended to be replaced by, the scoping confirmation performed by the entity’s assessor during
the assessment.

Segmentation
Segmentation (or isolation) of the CDE from the remainder of an entity’s network is not a PCI DSS requirement. However, it is strongly
recommended as a method that may reduce the:

Scope of the PCI DSS assessment

Cost of the PCI DSS assessment

Cost and difficulty of implementing and maintaining PCI DSS controls

Risk to an organization relative to payment card account data (reduced by consolidating that data into fewer, more controlled locations)Without adequate segmentation (sometimes called a "flat network"), the entire network is in scope for the PCI DSS assessment. Segmentation
can be achieved using a number of physical or logical methods, such as properly configured internal network security controls, routers withstrong access control lists, or other technologies that restrict access to a particular segment of a network. To be considered out of scope for
PCI DSS, a system component must be properly segmented (isolated) from the CDE, such that the out-of-scope system component could not
impact the security of the CDE, even if that component was compromised.
An important prerequisite to reduce the scope of the CDE is a clear understanding of business needs and processes related to the storage,
processing, and transmission of account data. Restricting account data to as few locations as possible by eliminating unnecessary data andconsolidating necessary data may require reengineering of long-standing business practices.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 12Documenting account data flows via a data-flow diagram helps an entity fully understand how account data comes into an organization, where
it resides within the organization, and how it traverses through various systems within the organization. Data-flow diagrams also illustrate all
locations where account data is stored, processed, and transmitted. This information supports an entity implementing segmentation and canalso support confirming that segmentation is being used to isolate the CDE from out-of-scope networks.
If segmentation is used to reduce the scope of the PCI DSS assessment, the assessor must verify that the segmentation is adequate to
reduce the scope of the assessment, as illustrated in Figure 2. At a high level, adequate segmentation isolates systems that store, process, ortransmit account data from those that do not. However, the adequacy of a specific segmentation implementation is highly variable anddepends on several factors such as a given network's configuration, the technologies deployed, and other controls that may be implemented.

Figure 2. Segmentation and Impact to PCI DSS Scope

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 13

WirelessIf wireless technology is used to store, process, or transmit account data (for example, wireless point-of-sale devices), or if a wireless local
area network (WLAN) is part of or connected to the CDE, the PCI DSS requirements and testing procedures for securing wirelessenvironments apply and must be performed.
Rogue wireless detection must be performed per PCI DSS Requirement 11.2.1 even when wireless is not used within the CDE and the entity
has a policy that prohibits the use of wireless technology within its environment. This is because of the ease with which a wireless accesspoint can be attached to a network, the difficulty in detecting its presence, and the increased risk presented by unauthorized wireless devices.
Before wireless technology is implemented, an entity should carefully evaluate the need for the technology against the risk. Consider
deploying wireless technology only for non-sensitive data transmission.

Encrypted Cardholder Data and Impact on PCI DSS Scope
Encryption of cardholder data with strong cryptography is an acceptable method of rendering the data unreadable according to PCI DSS
Requirement 3.5. However, encryption alone is generally insufficient to render the cardholder data out of scope for PCI DSS and does notremove the need for PCI DSS in that environment. The entity’s environment is still in scope for PCI DSS due to the presence of cardholder
data. For example, for a merchant card-present environment, there is physical access to the payment cards to complete a transaction andthere may also be paper reports or receipts with cardholder data. Similarly, in merchant card-not-present environments, such as mailorder/telephone-order and e-commerce, payment card details are provided via channels that need to be evaluated and protected according to
PCI DSS.
The following are each in scope for PCI DSS:Systems performing encryption and/or decryption of cardholder data, and systems performing key management functions,

Encrypted cardholder data that is not isolated from the encryption and decryption and key management processes,



Encrypted cardholder data that is present on a system or media that also contains the decryption key,Encrypted cardholder data that is present in the same environment as the decryption key,Encrypted cardholder data that is accessible to an entity that also has access to the decryption key.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 14

Note: A PCI-listed P2PE solution can significantly reduce the number of PCI DSS requirements applicable to a merchant’s cardholder data
environment. However, it does not completely remove the applicability of PCI DSS in the merchant environment.

Encrypted Cardholder Data and Impact to PCI DSS Scope for Third-Party Service Providers
Where a third-party service provider (TPSP) receives and/or stores only data encrypted by another entity, and where they do not have theability to decrypt the data, the TPSP may be able to consider the encrypted data out of scope if certain conditions are met. This is because
responsibility for the data generally remains with the entity, or entities, with the ability to decrypt the data or impact the security of theencrypted data. Determining which party is responsible for specific PCI DSS controls will depend on several factors, including who has accessto the decryption keys, the role performed by each party, and the agreement between parties. Responsibilities should be clearly defined anddocumented to ensure both the TPSP and the entity providing the encrypted data understand which entity is responsible for which security
controls.
As an example, a TPSP providing storage services receives and stores encrypted cardholder data provided by customers for back-up
purposes. This TPSP does not have access to the encryption or decryption keys, nor does it perform any key management for its customers.
The TPSP can exclude any such encrypted data when determining its PCI DSS scope. However, the TPSP does maintain responsibility forcontrolling access to the encrypted data storage as part of its service agreements with its customers.
Responsibility for ensuring that the encrypted data and the cryptographic keys are protected according to applicable PCI DSS requirements isoften shared between entities. In the above example, the customer determines which of their personnel are authorized to access the storage
media, and the storage facility is responsible for managing the physical and/or logical access controls to ensure that only persons authorized
by the customer are granted access to the storage media. The specific PCI DSS requirements applicable to a TPSP will depend on theservices provided and the agreement between the two parties. In the example of a TPSP providing storage services, the physical and logicalaccess controls provided by the TPSP will need to be reviewed at least annually. This review could be performed as part of the merchant’s
PCI DSS assessment or, alternatively, the review could be performed, and controls validated, by the TPSP with appropriate evidence provided
to the merchant. For information about “appropriate evidence,” see Options for TPSPs to Validate PCI DSS Compliance for TPSP Services
that Meet Customers’ PCI DSS Requirements.
As another example, a TPSP that receives only encrypted cardholder data for the purposes of routing to other entities, and that does not haveaccess to the data or cryptographic keys, may not have any PCI DSS responsibility for that encrypted data. In this scenario, where the TPSP
is not providing any security services or access controls, they may be considered the same as a public or untrusted network, and it would be
the responsibility of the entity(s) sending/receiving account data through the TPSP’s network to ensure PCI DSS controls are applied toprotect the data being transmitted.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 15

Use of Third-Party Service Providers
An entity (referred to as the “customer” in this section) might choose to use a third-party service provider (TPSP) to store, process, or transmit
account data or to manage in-scope system components on the customer’s behalf. Use of a TPSP may have an impact on the security of acustomer’s CDE.
Note: Use of a PCI DSS compliant TPSP does not make a customer PCI DSS compliant, nor does it remove the customer’s responsibility for
its own PCI DSS compliance. Even if a customer uses a TPSP to meet all account data functions, that customer remains responsible for
confirming its own compliance as requested by organizations that manage compliance programs (for example, payment brands andacquirers). Customers should contact the organizations of interest for any requirements.

Using TPSPs and the Impact on Customers Meeting PCI DSS Requirement 12.8
There are many different scenarios where a customer might use one or more TPSPs for functions within or related to the customer’s
CDE. In all scenarios where a TPSP is used, the customer must manage and oversee the PCI DSS compliance status of all their TPSPs
in accordance with Requirement 12.8, including TPSPs that:

Have access to the customer’s CDE,

Manage in-scope system components on the customer’s behalf, and/or

Can impact the security of the customer’s CDE.

Managing TPSPs in accordance with Requirement 12.8 includes performing due diligence, having appropriate agreements in place,identifying which requirements apply to the customer and which apply to the TPSP, and monitoring the compliance status of TPSPs atleast annually.
Requirement 12.8 does not specify that the customer’s TPSPs must be PCI DSS compliant, only that the customer monitor theircompliance status as specified in the requirement. Therefore, a TPSP does not need to be PCI DSS compliant for its customer to meet
Requirement 12.8.

Impact of Using TPSPs for Services that Meet Customers’ PCI DSS Requirements
When the TPSP provides a service that meets a PCI DSS requirement(s) on the customer’s behalf or where that service may impact the
security of the customer’s CDE, then those requirements are in scope for the customer’s assessment and the compliance of that service
will impact the customer’s PCI DSS compliance. The TPSP must demonstrate it meets applicable PCI DSS requirements for thoserequirements to be in place for its customers. For example, if an entity engages a TPSP to manage its network security controls, and the
TPSP does not provide evidence that it meets the applicable requirements in PCI DSS Requirement 1, then those requirements are notin place for the customer’s assessment. As another example, TPSPs that store backups of cardholder data on behalf of customers
Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 16

would need to meet the applicable requirements related to access controls, physical security, etc., for their customers to consider thoserequirements in place for their assessments.

Importance of Understanding Responsibilities Between TPSP Customers and TPSPs
Customers and TPSPs should clearly identify and understand the following:The services and system components included in the scope of the TPSP’s PCI DSS assessment,The specific PCI DSS requirements and sub-requirements covered by the TPSP’s PCI DSS assessment,

Any requirements that are the responsibility of the TPSP’s customers to include in their own PCI DSS assessments, and

Any PCI DSS requirements for which the responsibility is shared between the TPSP and its customers.

For example, a cloud provider should clearly define which of its IP addresses are scanned as part of its quarterly vulnerability scan
process and which IP addresses are their customers’ responsibility to scan.
Per Requirement 12.9.2, TPSPs are required to support their customers’ requests for information about the TPSP’s PCI DSS
compliance status related to the services provided to customers, and about which PCI DSS requirements are the responsibility of the
TPSP, which are the responsibility of the customer, and any responsibilities between the customer and the TPSP. Refer to Tips andTools for Understanding PCI DSS v4.0 for a responsibility matrix template that may be used for documenting and clarifying how
responsibilities are shared between TPSPs and customers.

Options for TPSPs to Validate PCI DSS Compliance for TPSP Services that Meet Customers’ PCI DSS
Requirements
TPSPs are responsible for demonstrating their PCI DSS compliance as requested by organizations that manage compliance programs(for example, payment brands and acquirers). TPSPs should contact the organizations of interest for any requirements.
When a TPSP provides services that are intended to meet or facilitate meeting a customer’s PCI DSS requirements or that may impact
the security of a customer’s CDE, these requirements are in scope for the customer’s PCI DSS assessments. There are two options for
TPSPs to validate compliance in this scenario:Annual assessment: TPSP undergoes an annual PCI DSS assessment(s) and provides evidence to its customers to show the
TPSP meets the applicable PCI DSS requirements; orMultiple, on-demand assessments: If a TPSP does not undergo an annual PCI DSS assessment, it must undergo assessments
upon request of their customers and/or participate in each of its customers’ PCI DSS assessments, with the results of each review
provided to the respective customer(s).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 17

If the TPSP undergoes its own PCI DSS assessment, it is expected to provide sufficient evidence to its customers to verify that thescope of the TPSP’s PCI DSS assessment covered the services applicable to the customer, and that the relevant PCI DSS
requirements were examined and determined to be in place. If the provider has an PCI DSS Attestation of Compliance (AOC), it isexpected that the TPSP provides the AOC to customers upon request. The customer may also request relevant sections of the TPSP’s
PCI DSS Report on Compliance (ROC). The ROC may be redacted to protect any confidential information.
If the TPSP does not undergo its own PCI DSS assessment and therefore does not have an AOC, the TPSP is expected to provide
specific evidence related to the applicable PCI DSS requirements, so that the customer (or its assessor) is able to confirm the TPSP is
meeting those PCI DSS requirements.

TPSPs Presence on a Payment Brand List(s) of PCI DSS Compliant Service Providers
For a customer that is monitoring a TPSP’s compliance status in accordance with Requirement 12.8, the TPSP’s presence on a
payment brand’s list of PCI DSS compliant service providers may be sufficient evidence of the TPSP’s compliance status if it is clear
from the list that the services applicable to the customer were covered by the TPSP’s PCI DSS assessment. If it is not clear from the list,
the customer should obtain other written confirmation that addresses the TPSP’s PCI DSS compliance status.
For a customer that is looking for evidence of PCI DSS compliance for requirements that a TPSP meets on a customer’s behalf or
where the service provided can impact the security of the customer’s CDE, the TPSP’s presence on a payment brand’s list of PCI DSS
compliant service providers is not sufficient evidence that the applicable PCI DSS requirements for that TPSP were included in theassessment. If the TPSP has an PCI DSS AOC, it is expected to provide it to customers upon request.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 18

5

Best Practices for Implementing PCI DSS into Business-as-Usual Processes
An entity that implements business-as-usual processes, otherwise known as BAU, as part of their overall security strategy is taking measures
to ensure that security controls that have been implemented to secure data and an environment continue to be implemented correctly andfunctioning properly as normal course of business.
Some PCI DSS requirements are intended to act as BAU processes by monitoring security controls to ensure their effectiveness on an
ongoing basis. This oversight by the entity assists with providing reasonable assurance that the compliance of its environment is preserved
between PCI DSS assessments. While there are currently some BAU requirements defined within the standard, an entity should adopt
additional BAU processes specific to their organization and environment when possible. BAU processes are a way to verify that automatedand manual controls are performing as expected. Regardless of whether a PCI DSS requirement is automated or manual, it is important for
BAU processes to detect anomalies, and alert and report so that responsible individuals address the situation in a timely manner.
Examples of how PCI DSS should be incorporated into BAU activities include but are not limited to:Assigning overall responsibility and accountability for PCI DSS compliance to an individual or team. This can include a charter definedby executive management for a specific PCI DSS compliance program and communication to executive management.



Developing performance metrics to measure the effectiveness of security initiatives and continuous monitoring of security controls,
including those that are heavily relied upon, such as network security controls, intrusion-detection systems/intrusion-prevention systems(IDS/IPS), change-detection mechanisms, anti-malware solutions, and access controls, to ensure they are operating effectively and asintended.



Reviewing logged data more frequently to gain insights to trends or behaviors that may not be obvious with only monitoring.

Ensuring that all failures in security controls are detected and responded to promptly. Processes to respond to security control failures
should include:–

Restoring the security control.

–

Identifying the cause of failure.

–

Identifying and addressing any security issues that arose during the failure of the security control.

–

Implementing mitigation, such as process or technical controls, to prevent the cause of the failure from recurring.

–Resuming monitoring of the security control, perhaps with enhanced monitoring for a period of time, to verify the control is operating
effectively.

Reviewing changes that could introduce security risks to the environment (for example, addition of new systems, changes in system or
network configurations) prior to completing the change, and including the following:

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 19–

Perform a risk assessment to determine the potential impact to PCI DSS scope (for example, a new network security control rulethat permits connectivity between a system in the CDE and another system could bring additional systems or networks into scopefor PCI DSS).

–

Identify PCI DSS requirements applicable to systems and networks affected by the changes (for example, if a new system is in
scope for PCI DSS, it would need to be configured per system configuration standards, including change-detection mechanisms,
anti-malware software, patches, and audit logging. These new systems and networks would need to be added to the inventory of inscope system components and to the quarterly vulnerability scan schedule).

–

Update PCI DSS scope and implement security controls as appropriate.

–

Update documentation to reflect implemented changes.



Reviewing the impact to PCI DSS scope and requirements upon changes to organizational structure (for example, a company merger or
acquisition).



Reviewing external connections and third-party access periodically.

For entities that use third parties for software development, periodically confirming that those software development activities continue tocomply with software development requirements in Requirement 6.

Performing periodic reviews to confirm that PCI DSS requirements continue to be in place and personnel follow established processes.
Periodic reviews should cover all facilities and locations, including retail outlets and data centers, whether self-managed or if a TPSP isused. For example, periodic reviews can be used to confirm that configuration standards have been applied to applicable systems,
default vendor accounts and passwords are removed or disabled, patches and anti-malware solutions are up to date, audit logs arebeing reviewed, and so on. The frequency of periodic reviews should be determined by the entity as appropriate for the size andcomplexity of their environment, if not otherwise stated in PCI DSS.

These reviews can also be used to verify that required evidence for a PCI DSS assessment is being maintained. For example, evidence ofaudit logs, vulnerability scan reports, and reviews of network security control rulesets are necessary to assist the entity in preparing for its next
PCI DSS assessment.


Establishing communication with all impacted parties, both external and internal, about newly identified threats and changes to theorganization structure. Communication materials should help recipients understand the impact of threats, mitigating steps, and contact
points for further information or escalation.



Reviewing hardware and software technologies at least once every 12 months to confirm that they continue to be supported by thevendor and can meet the entity’s security requirements, including PCI DSS. If technologies are no longer supported by the vendor or
cannot meet the entity’s security needs, the entity should prepare a remediation plan, including replacement of the technology, as
necessary.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 20

Note: Some best practices in this section are also included as PCI DSS requirements for certain entities. For example, those undergoing a full
PCI DSS assessment, service providers validating to the additional “service provider only” requirements, and designated entities that are
required to validate according to Appendix A3: Designated Entities Supplemental Validation.
Each entity should consider implementing these best practices into their environment, even if the entity is not required to validate to them (forexample, merchants undergoing self-assessment).
Refer to Best Practices for Maintaining PCI DSS Compliance in the Document Library on the PCI SSC website for additional guidance.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 21

6

For Assessors: Sampling for PCI DSS Assessments
Sampling is an option for assessors conducting PCI DSS assessments to facilitate the assessment process when there are large numbers of
items in a population being tested.
While it is acceptable for an assessor to sample from similar items in a population being tested as part of its review of an entity’s PCI DSS
compliance, it is not acceptable for an entity to apply PCI DSS requirements to only a sample of its environment (for example, requirements forquarterly vulnerability scans apply to all system components). Similarly, it is not acceptable for an assessor to review only a sample of PCI
DSS requirements for compliance.
While sampling allows assessors to test less than 100% of a given sampling population, assessors should always strive for the most complete
review possible. Assessors are encouraged to use automated processes or other mechanisms if the complete population, regardless of size,
can be tested quickly and efficiently with minimal impact on the resources of the entity being assessed. Where automated processes are notavailable to test 100% of a population, sampling is an equally acceptable approach.
After considering the overall scope, complexity, and consistency of the environment being assessed, and the nature (automated or manual) of
the processes used by an entity to meet a requirement, the assessor may independently select representative samples from the populations
being reviewed in order to assess the entity’s compliance with PCI DSS requirements. Samples must be a representative selection of all
variants of the population and must be sufficiently large to provide the assessor with assurance that controls are implemented as expectedacross the entire population. Where testing the periodic performance of a requirement (for example, weekly or quarterly, or periodically), theassessor should attempt to select a sample that represents the entire period covered by the assessment so that the assessor may make areasonable judgment that the requirement was met throughout the assessment period. Testing the same sample of items year after year could
allow unknown variations in the non-sampled items to remain undetected. Assessors must revalidate the sampling rationale for each
assessment and consider previous sample sets. Different samples must be selected for each assessment.
Appropriate selection of the sample depends on what is being considered in examining the sample members. For example, determining thepresence of anti-malware on servers known to be affected by malicious software may lead to determining the population to be all servers in
the environment, or all servers in the environment that are running a particular operating system, or all servers that are not mainframes, etc.
Selection of an appropriate sample would then include representatives of ALL members of the identified population, including all servers
running the identified operating system including all versions, as well as servers within the population that are used for different functions (webserver, application servers, database servers, etc.).
In the case that a specific configuration item is being considered, the population might be appropriately divided, and separate sample groups
identified. For example, a sample of all servers may not be appropriate when reviewing an operating system configuration setting, where
different operating systems are present within the environment. In this case, samples from each operating system type would be appropriate in
identifying that the configuration has been appropriately set for each operating system. Each sample set should include servers that are
representative of each operating system type, including version, as well as representative functions.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 22Other examples of sampling include selections of personnel with similar or varied roles, based on the requirement being assessed, forexample, a sample of administrators vs. a sample of all employees.
The assessor is required to use professional judgment in the planning, performance, and evaluation of the sample to support their conclusion
about whether and how the entity has met a requirement. The assessor’s goal in sampling is to obtain enough evidence to have a reasonablebasis for their opinion. When independently selecting samples, assessors should consider the following:

The assessor must select the sample from the complete population without influence from the assessed entity.



If the entity has standardized processes and controls in place that ensure consistency and which is applied to each item in the
population, the sample can be smaller than if the entity has no standardized processes/controls in place. The sample must be large
enough to provide the assessor with reasonable assurance that items in the population adhere to the standardized processes that are
applied to each item in the population. The assessor must verify that the standardized controls are implemented and working effectively.



If the entity has more than one type of standardized process in place (for example, for different types of business facilities/systemcomponents), the sample must include items subject to each type of process. For example, populations could be divided into subpopulations based on characteristics that may impact the consistency of the assessed requirements, such as the use of different
processes or tools. Samples would then be selected from each sub-population.



If the entity has no standardized PCI DSS processes/controls in place and each item in the population is managed through nonstandardized processes, the sample must be larger for the assessor to be assured that the PCI DSS requirements are appropriately
applied to each item in the population.

Samples of system components must include every type and combination being used. When an entity has more than one CDE, samples
must include populations across all in-scope system components. For example, where applications are sampled, the sample must
include all versions and platforms for each type of application.

Sample sizes must always be greater than one unless there is only one item in the given population, or an automated control is used
where the assessor has confirmed the control is functioning as programmed for each assessed sample population.



If the assessor relies on standardized processes and controls being in place as a basis for selecting a sample, but then finds out during
testing that standardized processes and controls are not in place or not operating effectively, the assessor should then increase thesample size to attempt to gain assurance that PCI DSS requirements are being met.

For each instance where sampling is used, the assessor must:

Document the rationale behind the sampling technique and sample size.

Validate and document the standardized processes and controls used to determine sample size.

Explain how the sample is appropriate and representative of the overall population.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 23

Figure 3 shows considerations for determining sample size.

Figure 3. PCI DSS Sampling Considerations

Note: In PCI DSS v4.0, specific references to sampling have been removed from all testing procedures. These references were removed
because calling out sampling only in some testing procedures may have implied that sampling was mandatory for those testing procedures(which it was not) or that sampling was only allowable where it was specifically mentioned. Assessors should select samples when it isappropriate to the population being tested, and, per above, render those decisions after considering the overall scope and complexity of anenvironment.
Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 24

7

Description of Timeframes Used in PCI DSS Requirements
Certain PCI DSS requirements have been established with specific timeframes for activities that need to be performed consistently via aregularly scheduled and repeatable process. The intent is that the activity is performed at an interval as close to that timeframe as possible
without exceeding it. The entity has the discretion to perform an activity more often than specified (for example, performing an activity monthly
where the PCI DSS requirement specifies it be performed every three months).
Table 4 outlines the frequency for the different time periods used in PCI DSS Requirements.

Table 4. PCI DSS Requirement Timeframes
Timeframes in PCI DSS
Requirements

Descriptions and Examples

Daily

Every day of the year (not only on business days).

WeeklyAt least once every seven days.

Monthly

At least once every 30 to 31 days, or on the nth day of the month.

Every three months(“quarterly”)

At least once every 90 to 92 days, or on the nth day of each third month.

Every six months

At least once every 180 to 184 days, or on the nth day of each sixth month.

Every 12 months(“annually”)

At least once every 365 (or 366 for leap years) days or on the same date every year.

Periodically

Frequency of occurrence is at the entity’s discretion and is documented and supported by the entity’s risk analysis. The entity
must demonstrate that the frequency is appropriate for the activity to be effective and to meet the intent of the requirement.

Immediately

Without delay. In real time or near real time.

Promptly

As soon as reasonably possible.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 25

Timeframes in PCI DSS
Requirements
Significant change

Descriptions and Examples
There are certain requirements for which performance is specified upon a significant change in an entity’s environment. Whilewhat constitutes a significant change is highly dependent on the configuration of a given environment, each of the following
activities, at a minimum, has potential impacts on the security of the CDE and must be considered as a significant change in thecontext of related PCI DSS requirements:•

New hardware, software, or networking equipment added to the CDE.

•

Any replacement or major upgrades of hardware and software in the CDE.

•

Any changes in the flow or storage of account data.

•

Any changes to the boundary of the CDE and/or to the scope of the PCI DSS assessment.

•

Any changes to the underlying supporting infrastructure of the CDE (including, but not limited to, changes to directory
services, time servers, logging, and monitoring).

•

Any changes to third party vendors/service providers (or services provided) that support the CDE or meet PCI DSS
requirements on behalf of the entity.

For other PCI DSS requirements, where the standard does not define a minimum frequency for recurring activities but instead allows for therequirement to be met “periodically,” the entity is expected to define the frequency as appropriate for its business. The frequency defined by
the entity must be supported by the entity’s security policy and the risk analysis conducted according to PCI DSS Requirement 12.3.1. The
entity must also be able to demonstrate that the frequency it has defined is appropriate for the activity to be effective and to meet the intent of
the requirement.
In both cases, where PCI DSS specifies a required frequency and where PCI DSS allows for “periodic” performance, the entity is expected tohave documented and implemented processes to ensure that activities are performed within a reasonable timeframe, including at least thefollowing:The entity is promptly notified any time an activity is not performed per its defined schedule,The entity determines the events that led to missing a scheduled activity,The entity performs the activity as soon as possible after it is missed and either gets back on schedule or establishes a new schedule,The entity produces documentation that shows the above elements occurred.

When an entity has the above processes in place to detect and address when a scheduled activity is missed, a reasonable approach isallowable, meaning that if an activity is required to be performed at least once every three months, the entity is not automatically noncompliant if the activity is performed late where the entity’s documented and implemented process (per above) was followed. However, where
no such process is in place and/or the activity was not performed according to schedule due to oversight, mismanagement, or lack ofmonitoring, the entity has not met the requirement. In such cases, the requirement will only be in place when the entity 1) documents (orPayment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 26

reconfirms) the process per above to ensure the scheduled activity occurs on time, 2) re-establishes the schedule, and 3) provides evidence
that the entity has performed the scheduled activity at least once per their schedule.
Note: For an initial PCI DSS assessment (meaning an entity has never undergone a prior assessment), where a requirement has a defined
timeframe within which an activity is to occur, it is not required that the activity has been performed for every such timeframe during theprevious year, if the assessor verifies:•

The activity was performed in accordance with the applicable requirement within the most recent timeframe (for example, the most recent
three-month or six-month period), and•The entity has documented policies and procedures for continuing to perform the activity within the defined timeframe.

For subsequent years after the initial assessment, the activity must have been performed at least once within each required timeframe. For
example, an activity required every three months must have been performed at least four times during the previous year at an interval that
does not exceed 90-92 days.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 27

8

Approaches for Implementing and Validating PCI DSS
To support flexibility in how security objectives are met, there are two approaches for implementing and validating to PCI DSS. Entities should
identify the approach best suited to their security implementation and use that approach to validate the controls.
Defined Approach

Follows the traditional method for implementing and validating PCI DSS and uses the Requirements and Testing
Procedures defined within the standard. In the defined approach, the entity implements security controls to meetthe stated requirements, and the assessor follows the defined testing procedures to verify that requirements
have been met.
The defined approach supports entities with controls in place that meet PCI DSS requirements as stated. Thisapproach may also suit entities that want more direction about how to meet security objectives, as well as
entities new to information security or PCI DSS.
Compensating Controls
As part of the defined approach, entities that cannot meet a PCI DSS
requirement explicitly as stated due to a legitimate and documented technicalor business constraint may implement other, or compensating, controls, thatsufficiently mitigate the risk associated with the requirement. On an annual
basis, any compensating controls must be documented by the entity andreviewed and validated by the assessor and included with the Report on
Compliance submission.

Customized Approach

Focuses on the Objective of each PCI DSS requirement (if applicable),allowing entities to implement controls to meet the requirement’s stated
Customized Approach Objective in a way that does not strictly follow thedefined requirement. Because each customized implementation will bedifferent, there are no defined testing procedures; the assessor is required toderive testing procedures that are appropriate to the specific implementation tovalidate that the implemented controls meet the stated Objective.

Note: For more details, see
Appendix B: Compensating
Controls and Appendix C:
Compensating Controls
Worksheet.

Note: For more details, see
Appendix D: Customized
Approach and Appendix E:
Sample Templates to
Support Customized
Approach.

The customized approach supports innovation in security practices, allowing entities greater flexibility to show
how their current security controls meet PCI DSS objectives. This approach is intended for risk-mature entities
that demonstrate a robust risk-management approach to security, including, but not limited to, a dedicated riskmanagement department or an organization-wide risk management approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 28

The controls implemented and validated using the customized approach are expected to meet or exceed the
security provided by the requirement in the defined approach. The level of documentation and effort required tovalidate customized implementations will also be greater than for the defined approach
Most PCI DSS requirements can be met using either the defined or customized approach. However, several requirements do not have astated Customized Approach Objective; the customized approach is not an option for these requirements.
Entities can use both the defined and customized approaches within their environment. This means an entity could use the defined approach
to meet some requirements and use the customized approach to meet other requirements. This also means that an entity could use thedefined approach to meet a given PCI DSS requirement for one system component or within one environment and use the customized
approach to meet that same PCI DSS requirement for a different system component or within a different environment. In this way, a PCI DSS
assessment could include both defined and customized testing procedures.
Figure 4 shows the two validation options for PCI DSS v4.0.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 29

Figure 4. PCI DSS Validation Approaches

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 30

9

Protecting Information About an Entity’s Security Posture
The processes related to becoming and maintaining a PCI DSS compliant environment results in many artifacts that an entity may consider
sensitive and may want to protect as such, including such items as the following:

The Report on Compliance or Self-Assessment Questionnaire (the associated Attestation of Compliance is not considered sensitive andthird-party service providers (TPSPs) are expected to share their AOC with customers).

Network diagrams and account data-flow diagrams, and security configurations and rules.



System configuration standards.



Cryptography and key management methods and protocols.

Entities should review all the artifacts related to PCI DSS controls or the assessment and protect them in accordance with the entity’s security
policies for this type of information.
TPSPs are required (PCI DSS Requirement 12.9) to support their customers with the following:

Information needed for customers to monitor the TPSPs’ PCI DSS compliance status (to enable the customer to comply with
Requirement 12.8), and

Evidence that the TPSP is meeting applicable PCI DSS requirements where the TPSP’s services are intended to meet or facilitate
meeting a customer’s PCI DSS requirements, or where those services may impact the security of a customer’s CDE.

This section does not impact or negate a TPSP’s obligation to support and provide information to their customers per Requirement 12.9.
For more details about expectations for TPSPs and relationships between TPSPs and customers, see Use of Third-Party Service Providers.

Protection of Confidential and Sensitive Information by Qualified Security Assessor Companies
Each Qualified Security Assessor (QSA) Company signs an agreement with PCI SSC that they will adhere to the Qualification Requirements
for QSAs. The Protection of Confidential and Sensitive Information section of that document includes the following:“The QSA company must have and adhere to a documented process for protection of confidential and sensitive information. This must
include adequate physical, electronic, and procedural safeguards consistent with industry-accepted practices to protect confidential andsensitive information against any threats or unauthorized access during storage, processing, and/or communicating of this information.
The QSA Company must maintain the privacy and confidentiality of information obtained in the course of performing its duties andobligations as a QSA Company, unless (and to the extent) disclosure is required by legal authority.”

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 31

10

Testing Methods for PCI DSS Requirements
The testing methods identified in the Testing Procedures for each requirement describe the expected activities to be performed by theassessor to determine whether the entity has met the requirement. The intent behind each testing method is described as follows:

Examine: The assessor critically evaluates data evidence. Common examples include documents (electronic or physical), screenshots,
configuration files, audit logs, and data files.

Observe: The assessor watches an action or views something in the environment. Examples of observation subjects include personnel
performing a task or process, system components performing a function or responding to input, environmental conditions, and physicalcontrols.

Interview: The assessor converses with individual personnel. Interview objectives may include confirmation of whether an activity is
performed, descriptions of how an activity is performed, and whether personnel have particular knowledge or understanding.

The testing methods are intended to allow the assessed entity to demonstrate how they have met a requirement. They also provide theassessed entity and the assessor with a common understanding of the assessment activities to be performed. The specific items to be
examined or observed and personnel to be interviewed should be appropriate for both the requirement being assessed and each entity’s
particular implementation. When documenting the assessment results, the assessor identifies the testing activities performed and the result ofeach activity.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 32

11

Instructions and Content for Report on Compliance

Instructions and content for the Report on Compliance (ROC) are provided in the PCI DSS Report on Compliance (ROC) Template.
The PCI DSS Report on Compliance (ROC) Template must be used as the template for creating a PCI DSS Report on Compliance.
Whether any entity is required to comply with or validate their compliance to PCI DSS is at the discretion of those organizations that manage
compliance programs (such as payment brands and acquirers). Entities should contact the organizations of interest to determine any reporting
requirements and instructions.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 33

12

PCI DSS Assessment Process
The PCI DSS assessment process includes the following high-level steps: 5
1. Confirm the scope of the PCI DSS assessment.
2. Perform the PCI DSS assessment of the environment.
3. Complete the applicable report for the assessment according to PCI DSS guidance and instructions.
4. Complete the Attestation of Compliance for Service Providers or Merchants, as applicable, in its entirety. Official Attestations ofCompliance are only available on the PCI SSC website.
5. Submit the applicable PCI SSC documentation and the Attestation of Compliance, along with any other requested documentation—suchas ASV scan reports—to the requesting organization (those that manage compliance programs such as payment brands and acquirers(for merchants), or other requesters (for service providers)).
6. If required, perform remediation to address requirements that are not in place and provide an updated report.
Note: PCI DSS requirements are not considered to be in place if controls are not yet implemented or are scheduled to be completed at afuture date. After any open or not-in-place items are addressed by the entity, the assessor will reassess to validate that the remediation iscompleted and that all requirements are satisfied. Refer to the following resources (available on the PCI SSC website) to document the PCI
DSS assessment:•

For instructions about completing reports on compliance (ROC), refer to the PCI DSS Report on Compliance (ROC) Template.

•

For instructions about completing self-assessment questionnaires (SAQ), refer to the PCI DSS SAQ Instructions and Guidelines.

•

For instructions about submitting PCI DSS compliance validation reports, refer to the PCI DSS Attestation of Compliance.

5

The PCI DSS assessment process, and the roles and responsibilities for completion of each step, vary depending on the type of assessment and on complianceprograms, which are managed by payment brands and acquirers.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 34

13

Additional References
Table 5 lists external organizations referenced within PCI DSS requirements or related guidance. These external organizations and theirreferences are provided as information only and do not replace or extend any PCI DSS requirement.

Table 5. External Organizations Referenced in PCI DSS Requirements
Reference

Full Name

SourceANSIAmerican National Standards Institutewww.ansi.org

CIS

Center for Internet Security

www.cisecurity.org

CSA

Cloud Security Alliancewww.csa.org

ENISA

European Union Agency for Cybersecurity(formerly European Network and Information Security Agency)

www.enisa.europa.eu

FIDO Alliance

The FIDO Alliancewww.fidoalliance.org

ISOInternational Organization for Standardizationwww.iso.org

NCSC

The UK National Cyber Security Centre

www.ncsc.gov.uk

NIST

National Institute of Standards and Technology

www.nist.gov

OWASP

Open Web Application Security Project

www.owasp.org

SAFEcode

Software Assurance Forum for Excellence in Codewww.safecode.org

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 35

14

PCI DSS Versions
As of the published date of this document, PCI DSS v3.2.1 is valid through 31 March 2024, after which it is retired. All PCI DSS validations
after this date must be to PCI DSS 4.0 or later.
Either PCI DSS version 3.2.1 or 4.0 can be used for assessments between March 2022 and 31 March 2024.
Table 6 summarizes PCI DSS versions and their relevant dates. 6

Table 6. PCI DSS Versions
VersionPublished

RetiredPCI DSS v4.0 (this document)

March 2022

To be determined

PCI DSS v3.2.1

May 2018

31 March 2024

6 Subject to change upon release of a new version of PCI DSS.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 36

15

Detailed PCI DSS Requirements and Testing Procedures
Figure 5 describes the column headings and content for the PCI DSS requirements.

Figure 5. Understanding the Parts of the Requirements
Guidance provides information
to understand how to meet arequirement. Guidance is not
required to be followed – itdoes not replace or extend any
PCI DSS requirement.
Not every Guidance section
described here is present foreach requirement.
Not every section will bepresent for each requirement.

The Requirement Description at
the X.X level organizes anddescribes the requirements that fallunder it.

The Defined Approach
Requirements and Testing
Procedures describes the
traditional method for
implementing and validating PCI
DSS using the Requirements andTesting Procedures defined in thestandard.

The Customized Approach
Objective is the intended goal oroutcome for the requirement. It
must be met by entities using a
Customized Approach. Most PCI
DSS requirements have thisObjective.
Appendix D describes
expectations for entities andassessors when the Customized
Approach is used.
Entities following the Defined
Approach can refer to theCustomized Approach
Objective as guidance, but theobjective does not replace orsupersede the Defined Approach
Requirement.

Purpose describes the goal,
benefit, or threat to be avoided;
why the requirement exists.

A Good Practice can beconsidered by the entity when
meeting a requirement.

Definitions Terms that may
help understand therequirement.

Applicability Notes apply to both the Defined andCustomized Approach. Includes information that
affects how the requirement is interpreted in thecontext of the entity or in scoping.
These notes are an integral part of PCI DSS andmust be fully considered during an assessment.

For each new PCI DSS v4.0
requirement with an extended
implementation period.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Examples describe ways arequirement could be met.

Further Information includes
references to relevant external
documentation.

March 2022
Page 37

Additional Requirements for Service Providers Only
Some requirements apply only when the entity being assessed is a service provider. These are identified within the requirement as “Additional
requirement for service providers only” and apply in addition to all other applicable requirements. Where the entity being assessed is both amerchant and a service provider, requirements noted as “Additional requirement for service providers only” apply to the service provider
portion of the entity’s business. Requirements identified with “Additional requirement for service providers only” are also recommended as bestpractices for consideration by all entities.

Appendices with Additional PCI DSS Requirements for Different Types of Entities
In addition to the 12 principal requirements, PCI DSS Appendix A contains additional PCI DSS requirements for different types of entities. The
sections within Appendix A include:Appendix A1: Additional PCI DSS Requirements for Multi-Tenant Service Providers.



Appendix A2: Additional PCI DSS Requirements for Entities using SSL/Early TLS for Card-Present POS POI Terminal
Connections.



Appendix A3: Designated Entities Supplemental Validation (DESV).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 38

Build and Maintain a Secure Network and Systems
Requirement 1: Install and Maintain Network Security Controls
Sections
1.1
1.2
1.3
1.4
1.5

Processes and mechanisms for installing and maintaining network security controls are defined and understood.
Network security controls (NSCs) are configured and maintained.
Network access to and from the cardholder data environment is restricted.
Network connections between trusted and untrusted networks are controlled.
Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 39

Overview
Network security controls (NSCs), such as firewalls and other network security technologies, are network policy enforcement points thattypically control network traffic between two or more logical or physical network segments (or subnets) based on pre-defined policies or rules.
NSCs examine all network traffic entering (ingress) and leaving (egress) a segment and decide, based on the policies defined, whether the
network traffic is allowed to pass or whether it should be rejected. Typically, NSCs are placed between environments with different security
needs or levels of trust, however in some environments NSCs control the traffic to individual devices irrespective of trust boundaries. Policy
enforcement generally occurs at layer 3 of the OSI model, but data present in higher layers is also frequently used to determine policy
decisions.
Traditionally this function has been provided by physical firewalls; however, now this functionality may be provided by virtual devices, cloudaccess controls, virtualization/container systems, and other software-defined networking technology.
NSCs are used to control traffic within an entity’s own networks—for example, between highly sensitive and less sensitive areas—and also toprotect the entity’s resources from exposure to untrusted networks. The cardholder data environment (CDE) is an example of a more sensitive
area within an entity’s network. Often, seemingly insignificant paths to and from untrusted networks can provide unprotected pathways into
sensitive systems. NSCs provide a key protection mechanism for any computer network.
Common examples of untrusted networks include the Internet, dedicated connections such as business-to-business communication channels,
wireless networks, carrier networks (such as cellular), third-party networks, and other sources outside the entity’s ability to control. Furthermore,
untrusted networks also include corporate networks that are considered out-of-scope for PCI DSS, because they are not assessed, andtherefore must be treated as untrusted because the existence of security controls has not been verified. While an entity may consider aninternal network to be trusted from an infrastructure perspective, if a network is out of scope for PCI DSS, that network must be considered
untrusted for PCI DSS.
Refer to Appendix G for definitions of PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 40Requirements and Testing Procedures

Guidance

1.1 Processes and mechanisms for installing and maintaining network security controls are defined and understood.

Defined Approach Requirements

Defined Approach Testing Procedures

1.1.1 All security policies and operational
procedures that are identified in Requirement 1 are:1.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures identified in Requirement 1
are managed in accordance with all elements
specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 1 are defined,
understood, and adhered to by affected personnel.
All supporting activities are repeatable, consistently
applied, and conform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 1.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 1.
While it is important to define the specific policies
or procedures called out in Requirement 1, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thesereasons, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives.

March 2022
Page 41Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.1.2 Roles and responsibilities for performing
activities in Requirement 1 are documented,
assigned, and understood.

1.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 1 are
documented and assigned.
1.1.2.b Interview personnel responsible for
performing activities in Requirement 1 to verify thatroles and responsibilities are assigned as
documented and are understood.

Customized Approach Objective
Day-to-day responsibilities for performing all theactivities in Requirement 1 are allocated. Personnel
are accountable for successful, continuous
operation of these requirements.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, personnel may not be aware of their
day-to-day responsibilities and critical activities
may not occur.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 42Requirements and Testing Procedures

Guidance

1.2 Network security controls (NSCs) are configured and maintained.

Defined Approach Requirements

Defined Approach Testing Procedures

1.2.1 Configuration standards for NSC rulesets are:1.2.1.a Examine the configuration standards for
NSC rulesets to verify the standards are inaccordance with all elements specified in thisrequirement.

•

Defined.

•

Implemented.

•

Maintained.

Customized Approach Objective

1.2.1.b Examine configuration settings for NSC
rulesets to verify that rulesets are implemented
according to the configuration standards.

The way that NSCs are configured and operate aredefined and consistently applied.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeThe implementation of these configuration
standards results in the NSC being configured
and managed to properly perform their security
function (often referred to as the ruleset).
Good Practice
These standards often define the requirements for
acceptable protocols, ports that are permitted to
be used, and specific configuration requirementsthat are acceptable. Configuration standards may
also outline what the entity considers not
acceptable or not permitted within its network.
Definitions
NSCs are key components of a networkarchitecture. Most commonly, NSCs are used at
the boundaries of the CDE to control network
traffic flowing inbound and outbound from theCDE.
Configuration standards outline an entity’s
minimum requirements for the configuration of its
NSCs
ExamplesExamples of NSCs covered by these
configuration standards include, but are notlimited to, firewalls, routers configured withaccess control lists, and cloud virtual networks.

March 2022
Page 43Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.2.2 All changes to network connections and to
configurations of NSCs are approved and managedin accordance with the change control process
defined at Requirement 6.5.1.

1.2.2.a Examine documented procedures to verify
that changes to network connections andconfigurations of NSCs are included in the formalchange control process in accordance with
Requirement 6.5.1.
1.2.2.b Examine network configuration settings to
identify changes made to network connections.
Interview responsible personnel and examinechange control records to verify that identified
changes to network connections were approved
and managed in accordance with Requirement
6.5.1.

Customized Approach Objective
Changes to network connections and NSCs cannot
result in misconfiguration, implementation of
insecure services, or unauthorized network
connections.

Guidance
Good Practice
Changes should be approved by individuals withthe appropriate authority and knowledge tounderstand the impact of the change. Verification
should provide reasonable assurance that thechange did not adversely impact the security of
the network and that the change performs as
expected.
To avoid having to address security issues
introduced by a change, all changes should beapproved prior to being implemented and verified
after the change is implemented. Once approved
and verified, network documentation should be
updated to include the changes to preventinconsistencies between network documentationand the actual configuration.

1.2.2.c Examine network configuration settings to
identify changes made to configurations of NSCs.
Interview responsible personnel and examinechange control records to verify that identified
changes to configurations of NSCs were approved
and managed in accordance with Requirement
6.5.1.

Applicability Notes
Changes to network connections include theaddition, removal, or modification of a connection.
Changes to NSC configurations include thoserelated to the component itself as well as thoseaffecting how it performs its security function.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 44Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.2.3 An accurate network diagram(s) is maintainedthat shows all connections between the CDE andother networks, including any wireless networks.

1.2.3.a Examine diagram(s) and network
configurations to verify that an accurate network
diagram(s) exists in accordance with all elements
specified in this requirement.

Customized Approach Objective
A representation of the boundaries between the
CDE, all trusted networks, and all untrusted
networks, is maintained and available.

1.2.3.b Examine documentation and interview
responsible personnel to verify that the network
diagram(s) is accurate and updated when there arechanges to the environment.

Applicability Notes
A current network diagram(s) or other technical or
topological solution that identifies network
connections and devices can be used to meet thisrequirement.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeMaintaining an accurate and up-to-date network
diagram(s) prevents network connections anddevices from being overlooked and unknowinglyleft unsecured and vulnerable to compromise.
A properly maintained network diagram(s) helps
an organization verify its PCI DSS scope byidentifying systems connecting to and from the
CDE.
Good PracticeAll connections to and from the CDE should be
identified, including systems providing security,
management, or maintenance services to CDE
system components. Entities should consider
including the following in their network diagrams:
All locations, including retail locations, data
centers, corporate locations, cloud providers,etc.
• Clear labeling of all network segments.
• All security controls providing segmentation,
including unique identifiers for each control(for example, name of control, make, model,
and version).
• All in-scope system components, including
NSCs, web app firewalls, anti-malware
solutions, change management solutions,
IDS/IPS, log aggregation systems, payment
terminals, payment applications, HSMs, etc.
• Clear labeling of any out-of-scope areas on
the diagram via a shaded box or othermechanism.
• Date of last update, and names of people thatmade and approved the updates.
• A legend or key to explain the diagram.
Diagrams should be updated by authorized
personnel to ensure diagrams continue to provide
an accurate description of the network.
•

March 2022
Page 45Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.2.4 An accurate data-flow diagram(s) is
maintained that meets the following:

1.2.4.a Examine data-flow diagram(s) andinterview personnel to verify the diagram(s) show
all account data flows in accordance with allelements specified in this requirement.

•

Shows all account data flows across systems
and networks.

•

Updated as needed upon changes to theenvironment.

Customized Approach Objective

1.2.4.b Examine documentation and interview
responsible personnel to verify that the data-flow
diagram(s) is accurate and updated when there arechanges to the environment.

A representation of all transmissions of accountdata between system components and acrossnetwork segments is maintained and available.

Applicability Notes
A data-flow diagram(s) or other technical or
topological solution that identifies flows of accountdata across systems and networks can be used tomeet this requirement.

Guidance
PurposeAn up-to-date, readily available data-flow diagram
helps an organization understand and keep trackof the scope of its environment by showing how
account data flows across networks and between
individual systems and devices.
Maintaining an up-to-date data-flow diagram(s)prevents account data from being overlooked andunknowingly left unsecured.
Good Practice
The data-flow diagram should include allconnection points where account data is received
into and sent out of the network, including
connections to open, public networks, application
processing flows, storage, transmissions between
systems and networks, and file backups.
The data-flow diagram is meant to be in addition
to the network diagram and should reconcile withand augment the network diagram. As a bestpractice, entities can consider including thefollowing in their data-flow diagrams:•

All processing flows of account data, including
authorization, capture, settlement,
chargeback, and refunds.

•

All distinct acceptance channels, including
card-present, card-not-present, and ecommerce.

•

All types of data receipt or transmission,
including any involving hard copy/paper
media.

•

The flow of account data from the point where
it enters the environment, to its final
disposition.

Where account data is transmitted andprocessed, where it is stored, and whether
storage is short term or long term.
(continued on next page)•

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 46

Requirements and Testing Procedures

Defined Approach Requirements

Defined Approach Testing Procedures

1.2.5 All services, protocols, and ports allowed are
identified, approved, and have a defined businessneed.

1.2.5.a Examine documentation to verify that a list
exists of all allowed services, protocols, and ports,
including business justification and approval for
each.

Customized Approach Objective

1.2.5.b Examine configuration settings for NSCs toverify that only approved services, protocols, andports are in use.

Unauthorized network traffic (services, protocols, orpackets destined for specific ports) cannot enter orleave the network.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance•

The source of all account data received (forexample, customers, third party, etc.), and any
entities with which account data is shared.

•

Date of last update, and names of people thatmade and approved the updates.

PurposeCompromises often happen due to unused or
insecure services (for example, telnet and FTP),
protocols, and ports, since these can lead to
unnecessary points of access being opened into
the CDE. Additionally, services, protocols, andports that are enabled but not in use are often
overlooked and left unsecured and unpatched. By
identifying the services, protocols, and ports
necessary for business, entities can ensure that
all other services, protocols, and ports are
disabled or removed.
Good PracticeThe security risk associated with each service,protocol, and port allowed should be understood.
Approvals should be granted by personnel
independent of those managing the configuration.
Approving personnel should possess knowledge
and accountability appropriate for making
approval decisions.

March 2022
Page 47

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.2.6 Security features are defined andimplemented for all services, protocols, and portsthat are in use and considered to be insecure, suchthat the risk is mitigated.

1.2.6.a Examine documentation that identifies all
insecure services, protocols, and ports in use toverify that for each, security features are defined tomitigate the risk.
1.2.6.b Examine configuration settings for NSCs toverify that the defined security features are
implemented for each identified insecure service,protocol, and port.

Customized Approach Objective
The specific risks associated with the use of
insecure services, protocols, and ports areunderstood, assessed, and appropriately mitigated.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeCompromises take advantage of insecure
network configurations.
Good Practice
If insecure services, protocols, or ports arenecessary for business, the risk posed by these
services, protocols, and ports should be clearly
understood and accepted by the organization, theuse of the service, protocol, or port should bejustified, and the security features that mitigate
the risk of using these services, protocols, andports should be defined and implemented by theentity.
Further Information
For guidance on services, protocols, or ports
considered to be insecure, refer to industry
standards and guidance (for example, from NIST,ENISA, OWASP).

March 2022
Page 48

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.2.7 Configurations of NSCs are reviewed at least
once every six months to confirm they are relevant
and effective.

1.2.7.a Examine documentation to verify
procedures are defined for reviewing
configurations of NSCs at least once every six
months.
1.2.7.b Examine documentation of reviews ofconfigurations for NSCs and interview responsible
personnel to verify that reviews occur at least once
every six months.

Customized Approach Objective
NSC configurations that allow or restrict access totrusted networks are verified periodically to ensurethat only authorized connections with a current
business justification are permitted.

1.2.7.c Examine configurations for NSCs to verify
that configurations identified as no longer being
supported by a business justification are removed
or updated.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeSuch a review gives the organization an
opportunity to clean up any unneeded, outdated,or incorrect rules and configurations which could
be utilized by an unauthorized person.
Furthermore, it ensures that all rules andconfigurations allow only authorized services,
protocols, and ports that match the documented
business justifications.
Good PracticeThis review, which can be implemented using
manual, automated, or system-based methods, isintended to confirm that the settings that manage
traffic rules, what is allowed in and out of the
network, match the approved configurations.
The review should provide confirmation that all
permitted access has a justified business reason.
Any discrepancies or uncertainties about a rule orconfiguration should be escalated for resolution.
While this requirement specifies that this review
occur at least once every six months,
organizations with a high volume of changes totheir network configurations may wish to consider
performing reviews more frequently to ensure thatthe configurations continue to meet the needs ofthe business.

March 2022
Page 49

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.2.8 Configuration files for NSCs are:1.2.8 Examine configuration files for NSCs to verify
they are in accordance with all elements specified
in this requirement.

•

Secured from unauthorized access.

•

Kept consistent with active network
configurations.

Customized Approach Objective
NSCs cannot be defined or modified using untrusted
configuration objects (including files).

Applicability Notes
Any file or setting used to configure or synchronize
NSCs is considered to be a “configuration file.” This
includes files, automated and system-based
controls, scripts, settings, infrastructure as code, orother parameters that are backed up, archived, or
stored remotely.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeTo prevent unauthorized configurations frombeing applied to the network, stored files withconfigurations for network controls need to be
kept up to date and secured against unauthorizedchanges.
Keeping configuration information current andsecure ensures that the correct settings for NSCs
are applied whenever the configuration is run.
ExamplesIf the secure configuration for a router is stored in
non-volatile memory, when that router is restarted
or rebooted, these controls should ensure that its
secure configuration is reinstated.

March 2022
Page 50Requirements and Testing Procedures

Guidance

1.3 Network access to and from the cardholder data environment is restricted.

Defined Approach Requirements

Defined Approach Testing Procedures

1.3.1 Inbound traffic to the CDE is restricted asfollows:

1.3.1.a Examine configuration standards for NSCs
to verify that they define restricting inbound traffic
to the CDE is in accordance with all elements
specified in this requirement.

•

To only traffic that is necessary.

•

All other traffic is specifically denied.

Customized Approach Objective
Unauthorized traffic cannot enter the CDE.

1.3.1.b Examine configurations of NSCs to verify
that inbound traffic to the CDE is restricted inaccordance with all elements specified in thisrequirement.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeThis requirement aims to prevent malicious
individuals from accessing the entity’s network via
unauthorized IP addresses or from using
services, protocols, or ports in an unauthorizedmanner.
Good PracticeAll traffic inbound to the CDE, regardless of whereit originates, should be evaluated to ensure it
follows established, authorized rules. Connections
should be inspected to ensure traffic is restricted
to only authorized communications—for example,
by restricting source/destination addresses andports, and blocking of content.
ExamplesImplementing a rule that denies all inbound andoutbound traffic that is not specifically needed—
for example, by using an explicit “deny all” orimplicit deny after allow statement—helps toprevent inadvertent holes that would allow
unintended and potentially harmful traffic.

March 2022
Page 51

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.3.2 Outbound traffic from the CDE is restricted asfollows:

1.3.2.a Examine configuration standards for NSCs
to verify that they define restricting outbound traffic
from the CDE in accordance with all elements
specified in this requirement.

•

To only traffic that is necessary.

•

All other traffic is specifically denied.

Customized Approach Objective
Unauthorized traffic cannot leave the CDE.

1.3.2.b Examine configurations of NSCs to verify
that outbound traffic from the CDE is restricted inaccordance with all elements specified in thisrequirement.

Defined Approach Requirements

Defined Approach Testing Procedures

1.3.3 NSCs are installed between all wirelessnetworks and the CDE, regardless of whether thewireless network is a CDE, such that:

1.3.3 Examine configuration settings and network
diagrams to verify that NSCs are implemented
between all wireless networks and the CDE, inaccordance with all elements specified in thisrequirement.

•

All wireless traffic from wireless networks into the
CDE is denied by default.

•

Only wireless traffic with an authorized businesspurpose is allowed into the CDE.

Customized Approach Objective
Unauthorized traffic cannot traverse network
boundaries between any wireless networks andwired environments in the CDE.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeThis requirement aims to prevent malicious
individuals and compromised system components
within the entity’s network from communicatingwith an untrusted external host.
Good PracticeAll traffic outbound from the CDE, regardless ofthe destination, should be evaluated to ensure it
follows established, authorized rules. Connections
should be inspected to restrict traffic to only
authorized communications—for example, byrestricting source/destination addresses andports, and blocking of content.
ExamplesImplementing a rule that denies all inbound andoutbound traffic that is not specifically needed—
for example, by using an explicit “deny all” orimplicit deny after allow statement—helps toprevent inadvertent holes that would allow
unintended and potentially harmful traffic.
PurposeThe known (or unknown) implementation andexploitation of wireless technology within a
network is a common path for malicious
individuals to gain access to the network andaccount data. If a wireless device or network is
installed without the entity’s knowledge, a
malicious individual could easily and “invisibly”
enter the network. If NSCs do not restrict accessfrom wireless networks into the CDE, malicious
individuals that gain unauthorized access to thewireless network can easily connect to the CDE
and compromise account information.

March 2022
Page 52

Requirements and Testing Procedures

Guidance

1.4 Network connections between trusted and untrusted networks are controlled.

Defined Approach Requirements

Defined Approach Testing Procedures

1.4.1 NSCs are implemented between trusted anduntrusted networks.

1.4.1.a Examine configuration standards andnetwork diagrams to verify that NSCs are defined
between trusted and untrusted networks.

Customized Approach Objective
Unauthorized traffic cannot traverse network
boundaries between trusted and untrusted
networks.

1.4.1.b Examine network configurations to verify
that NSCs are in place between trusted anduntrusted networks, in accordance with the
documented configuration standards and network
diagrams.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Purpose
Implementing NSCs at every connection coming
into and out of trusted networks allows the entity
to monitor and control access and minimizes the
chances of a malicious individual obtaining
access to the internal network via an unprotectedconnection.
ExamplesAn entity could implement a DMZ, which is a partof the network that manages connections
between an untrusted network (for examples of
untrusted networks refer to the Requirement 1
Overview) and services that an organizationneeds to have available to the public, such as a
web server. Please note that if an entity’s DMZ
processes or transmits account data (for example,
e-commerce website), it is also considered a
CDE.

March 2022
Page 53

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.4.2 Inbound traffic from untrusted networks totrusted networks is restricted to:

1.4.2 Examine vendor documentation andconfigurations of NSCs to verify that inbound traffic
from untrusted networks to trusted networks is
restricted in accordance with all elements specified
in this requirement.

•

Communications with system components thatare authorized to provide publicly accessible
services, protocols, and ports.

•

Stateful responses to communications initiatedby system components in a trusted network.

•

All other traffic is denied.

Customized Approach Objective
Only traffic that is authorized or that is a response toa system component in the trusted network canenter a trusted network from an untrusted network.

Applicability Notes
The intent of this requirement is to addresscommunication sessions between trusted anduntrusted networks, rather than the specifics ofprotocols.
This requirement does not limit the use of UDP orother connectionless network protocols if state ismaintained by the NSC.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeEnsuring that public access to a systemcomponent is specifically authorized reduces therisk of system components being unnecessarily
exposed to untrusted networks.
Good Practice
System components that provide publicly
accessible services, such as email, web, andDNS servers, are the most vulnerable to threats
originating from untrusted networks.
Ideally, such systems are placed within adedicated trusted network that is public facing (forexample, a DMZ) but that is separated via NSCsfrom more sensitive internal systems, which helps
protect the rest of the network in the event theseexternally accessible systems are compromised.
This functionality is intended to prevent malicious
actors from accessing the organization's internal
network from the Internet, or from using services,
protocols, or ports in an unauthorized manner.
Where this functionality is provided as a built-infeature of an NSC, the entity should ensure thatits configurations do not result in the functionality
being disabled or bypassed.
Definitions
Maintaining the "state" (or status) for eachconnection into a network means the NSC“knows” whether an apparent response to aprevious connection is a valid, authorized
response (since the NSC retains eachconnection’s status) or whether it is malicious
traffic trying to fool the NSC into allowing theconnection.

March 2022
Page 54Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.4.3 Anti-spoofing measures are implemented todetect and block forged source IP addresses fromentering the trusted network.

1.4.3 Examine vendor documentation andconfigurations for NSCs to verify that anti-spoofing
measures are implemented to detect and blockforged source IP addresses from entering thetrusted network.

Customized Approach Objective
Packets with forged IP source addresses cannot
enter a trusted network.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Filtering packets coming into the trusted network
helps to, among other things, ensure packets are
not “spoofed” to appear as if they are coming froman organization’s own internal network. For
example, anti-spoofing measures prevent internal
addresses originating from the Internet frompassing into the DMZ.
Good Practice
Products usually come with anti-spoofing set as adefault and may not be configurable. Entities
should consult the vendor's documentation for
more information.
ExamplesNormally, a packet contains the IP address of thecomputer that originally sent it so other computersin the network know where the packet originated.
Malicious individuals will often try to spoof (orimitate) the sending IP address to fool the target
system into believing the packet is from a trusted
source.

March 2022
Page 55

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.4.4 System components that store cardholder
data are not directly accessible from untrusted
networks.

1.4.4.a Examine the data-flow diagram andnetwork diagram to verify that it is documented thatsystem components storing cardholder data are
not directly accessible from the untrusted
networks.

Customized Approach Objective
Stored cardholder data cannot be accessed from
untrusted networks.

1.4.4.b Examine configurations of NSCs to verify
that controls are implemented such that systemcomponents storing cardholder data are notdirectly accessible from untrusted networks.

Guidance
Purpose
Cardholder data that is directly accessible from an
untrusted network, for example, because it isstored on a system within the DMZ or in a cloud
database service, is easier for an external
attacker to access because there are fewer
defensive layers to penetrate. Using NSCs toensure that system components that store
cardholder data (such as a database or a file) canonly be directly accessed from trusted networks
can prevent unauthorized network traffic fromreaching the system component.

Applicability Notes
This requirement is not intended to apply to storageof account data in volatile memory but does apply
where memory is being treated as persistentstorage (for example, RAM disk). Account data canonly be stored in volatile memory during the timenecessary to support the associated businessprocess (for example, until completion of the related
payment card transaction).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 56

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

1.4.5 The disclosure of internal IP addresses androuting information is limited to only authorizedparties.

1.4.5.a Examine configurations of NSCs to verify
that the disclosure of internal IP addresses androuting information is limited to only authorizedparties.

Customized Approach Objective
Internal network information is protected fromunauthorized disclosure.

1.4.5.b Interview personnel and examine
documentation to verify that controls are
implemented such that any disclosure of internal IP
addresses and routing information is limited to only
authorized parties.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeRestricting the disclosure of internal, private, andlocal IP addresses is useful to prevent a hacker
from obtaining knowledge of these IP addresses
and using that information to access the network.
Good Practice
Methods used to meet the intent of thisrequirement may vary, depending on the specificnetworking technology being used. For example,
the controls used to meet this requirement may
be different for IPv4 networks than for IPv6
networks.
ExamplesMethods to obscure IP addressing may include,
but are not limited to:• IPv4 Network Address Translation (NAT).
•

Placing system components behind proxy
servers/NSCs.

•

Removal or filtering of route advertisements
for internal networks that use registeredaddressing.

•Internal use of RFC 1918 (IPv4) or use IPv6
privacy extension (RFC 4941) when initiating
outgoing sessions to the internet.

March 2022
Page 57

Requirements and Testing Procedures

Guidance

1.5 Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.

Defined Approach Requirements

Defined Approach Testing Procedures

1.5.1 Security controls are implemented on any
computing devices, including company- andemployee-owned devices, that connect to both
untrusted networks (including the Internet) and the
CDE as follows:

1.5.1.a Examine policies and configuration
standards and interview personnel to verify
security controls for computing devices thatconnect to both untrusted networks, and the CDE,
are implemented in accordance with all elements
specified in this requirement.

•

Specific configuration settings are defined toprevent threats being introduced into theentity’s network.

•

Security controls are actively running.

•

Security controls are not alterable by users of
the computing devices unless specifically
documented and authorized by management ona case-by-case basis for a limited period.

1.5.1.b Examine configuration settings on
computing devices that connect to both untrusted
networks and the CDE to verify settings are
implemented in accordance with all elements
specified in this requirement.

PurposeComputing devices that are allowed to connect tothe Internet from outside the corporate
environment—for example, desktops, laptops,
tablets, smartphones, and other mobile computing
devices used by employees—are more vulnerable
to Internet-based threats.
Use of security controls such as host-based
controls (for example, personal firewall softwareor end-point protection solutions), network-based
security controls (for example, firewalls, networkbased heuristics inspection, and malware
simulation), or hardware, helps to protect devices
from Internet-based attacks, which could use thedevice to gain access to the organization’s
systems and data when the device reconnects tothe network.

Customized Approach Objective
Devices that connect to untrusted environments andalso connect to the CDE cannot introduce threats tothe entity’s CDE.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

(continued on next page)

March 2022
Page 58

Requirements and Testing Procedures
Applicability Notes
These security controls may be temporarily disabled
only if there is legitimate technical need, as
authorized by management on a case-by-casebasis. If these security controls need to be disabled
for a specific purpose, it must be formallyauthorized. Additional security measures may alsoneed to be implemented for the period during whichthese security controls are not active.
This requirement applies to employee-owned andcompany-owned computing devices. Systems thatcannot be managed by corporate policy introduce
weaknesses and provide opportunities thatmalicious individuals may exploit.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Good PracticeThe specific configuration settings are determinedby the entity and should be consistent with its
network security policies and procedures.
Where there is a legitimate need to temporarily
disable security controls on a company-owned or
employee-owned device that connects to both an
untrusted network and the CDE—for example, tosupport a specific maintenance activity or
investigation of a technical problem—the reason
for taking such action is understood and approvedby an appropriate management representative.
Any disabling or altering of these security
controls, including on administrators’ own
devices, is performed by authorized personnel.
It is recognized that administrators have privilegesthat may allow them to disable security controlson their own computers, but there should be
alerting mechanisms in place when such controls
are disabled and follow up that occurs to ensure
processes were followed.
ExamplesPractices include forbidding split-tunneling of
VPNs for employee-owned or corporate-owned
mobile devices and requiring that such devices
boot up into a VPN.

March 2022
Page 59

Requirement 2:

Apply Secure Configurations to All System Components
Sections

2.1
2.2
2.3

Processes and mechanisms for applying secure configurations to all system components are defined and understood.
System components are configured and managed securely.
Wireless environments are configured and managed securely.
Overview

Malicious individuals, both external and internal to an entity, often use default passwords and other vendor default settings to compromise
systems. These passwords and settings are well known and are easily determined via public information.
Applying secure configurations to system components reduces the means available to an attacker to compromise the system. Changing default
passwords, removing unnecessary software, functions, and accounts, and disabling or removing unnecessary services all help to reduce thepotential attack surface.
Refer to Appendix G for definitions of PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 60

Requirements and Testing Procedures

Guidance

2.1 Processes and mechanisms for applying secure configurations to all system components are defined and understood.

Defined Approach Requirements

Defined Approach Testing Procedures

2.1.1 All security policies and operational
procedures that are identified in Requirement 2 are:2.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures identified in Requirement 2
are managed in accordance with all elements
specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 2 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 2.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 2.
While it is important to define the specific policies
or procedures called out in Requirement 2, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle
Definitions
Security policies define the entity’s security
objectives and principles.
Operational procedures describe how to perform
activities, and define the controls, methods, andprocesses that are followed to achieve thedesired result in a consistent manner and inaccordance with policy objectives.

March 2022
Page 61Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

2.1.2 Roles and responsibilities for performing
activities in Requirement 2 are documented,
assigned, and understood.

2.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 2 are
documented and assigned.

Customized Approach Objective
Day-to-day responsibilities for performing all theactivities in Requirement 2 are allocated. Personnel
are accountable for successful, continuous
operation of these requirements.

2.1.2.b Interview personnel with responsibility for
performing activities in Requirement 2 to verify thatroles and responsibilities are assigned as
documented and are understood.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, personnel may not be aware of their
day-to-day responsibilities and critical activities
may not occur.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 62Requirements and Testing Procedures

Guidance

2.2 System components are configured and managed securely.

Defined Approach Requirements

Defined Approach Testing Procedures

2.2.1 Configuration standards are developed,
implemented, and maintained to:

2.2.1.a Examine system configuration standards
to verify they define processes that include all
elements specified in this requirement.

•

Cover all system components.

•

Address all known security vulnerabilities.

•

Be consistent with industry-accepted systemhardening standards or vendor hardening
recommendations.

•

Be updated as new vulnerability issues are
identified, as defined in Requirement 6.3.1.

•

Be applied when new systems are configured
and verified as in place before or immediately
after a system component is connected to a
production environment.

Customized Approach Objective

2.2.1.b Examine policies and procedures andinterview personnel to verify that system
configuration standards are updated as newvulnerability issues are identified, as defined in
Requirement 6.3.1.
2.2.1.c Examine configuration settings andinterview personnel to verify that system
configuration standards are applied when new
systems are configured and verified as being inplace before or immediately after a systemcomponent is connected to a production
environment.

All system components are configured securely andconsistently and in accordance with industryaccepted hardening standards or vendor
recommendations.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeThere are known weaknesses with many
operating systems, databases, network devices,
software, applications, container images, andother devices used by an entity or within an
entity’s environment. There are also known ways
to configure these system components to fix
security vulnerabilities. Fixing security
vulnerabilities reduces the opportunities available
to an attacker.
By developing standards, entities ensure theirsystem components will be configured
consistently and securely, and address theprotection of devices for which full hardening may
be more difficult.
Good Practice
Keeping up to date with current industry guidance
will help the entity maintain secure configurations.
The specific controls to be applied to a system willvary and should be appropriate for the type andfunction of the system.
Numerous security organizations haveestablished system-hardening guidelines andrecommendations, which advise how to correctcommon, known weaknesses.
Further Information
Sources for guidance on configuration standards
include but are not limited to: Center for Internet
Security (CIS), International Organization forStandardization (ISO), National Institute ofStandards and Technology (NIST), Cloud
Security Alliance, and product vendors.

March 2022
Page 63

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

2.2.2 Vendor default accounts are managed asfollows:

2.2.2.a Examine system configuration standards toverify they include managing vendor default
accounts in accordance with all elements specified
in this requirement.

•

If the vendor default account(s) will be used, thedefault password is changed per Requirement
8.3.6.

•

If the vendor default account(s) will not be used,
the account is removed or disabled.

Customized Approach Objective

2.2.2.b Examine vendor documentation andobserve a system administrator logging on using
vendor default accounts to verify accounts are
implemented in accordance with all elements
specified in this requirement.
2.2.2.c Examine configuration files and interview
personnel to verify that all vendor default accounts
that will not be used are removed or disabled.

System components cannot be accessed using
default passwords.

Applicability Notes
This applies to ALL vendor default accounts andpasswords, including, but not limited to, those usedby operating systems, software that provides
security services, application and system accounts,
point-of-sale (POS) terminals, payment applications,and Simple Network Management Protocol (SNMP)
defaults.
This requirement also applies where a systemcomponent is not installed within an entity’senvironment, for example, software and applications
that are part of the CDE and are accessed via acloud subscription service.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Malicious individuals often use vendor default
account names and passwords to compromise
operating systems, applications, and the systems
on which they are installed. Because thesedefault settings are often published and are wellknown, changing these settings will makesystems less vulnerable to attack.
Good Practice
All vendor default accounts should be identified,
and their purpose and use understood. It is
important to establish controls for application andsystem accounts, including those used to deploy
and maintain cloud services so that they do notuse default passwords and are not usable byunauthorized individuals.
Where a default account is not intended to be
used, changing the default password to a uniquepassword that meets PCI DSS Requirement
8.3.6, removing any access to the default
account, and then disabling the account, will
prevent a malicious individual from re-enabling
the account and gaining access with the default
password.
Using an isolated staging network to install andconfigure new systems is recommended and canalso be used to confirm that default credentials
have not been introduced into production
environments.
ExamplesDefaults to be considered include user IDs,
passwords, and other authentication credentials
commonly used by vendors in their products.

March 2022
Page 64

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

2.2.3 Primary functions requiring different security
levels are managed as follows:

2.2.3.a Examine system configuration standards toverify they include managing primary functions
requiring different security levels as specified inthis requirement.

Only one primary function exists on a systemcomponent,
OR•

Primary functions with differing security levels
that exist on the same system component are
isolated from each other,
OR

•

•

Primary functions with differing security levels on
the same system component are all secured to
the level required by the function with the highest
security need.

Customized Approach Objective
Primary functions with lower security needs cannot
affect the security of primary functions with higher
security needs on the same system component.

2.2.3.b Examine system configurations to verify
that primary functions requiring different security
levels are managed per one of the ways specified
in this requirement.
2.2.3.c Where virtualization technologies are used,examine the system configurations to verify thatsystem functions requiring different security levels
are managed in one of the following ways:•

Functions with differing security needs do not
co-exist on the same system component.

•

Functions with differing security needs that exist
on the same system component are isolated
from each other.

•

Functions with differing security needs on thesame system component are all secured to thelevel required by the function with the highest
security need.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Systems containing a combination of services,
protocols, and daemons for their primary function
will have a security profile appropriate to allowthat function to operate effectively. For example,
systems that need to be directly connected to theInternet would have a particular profile, like a
DNS server, web server, or an e-commerceserver. Conversely, other system components
may operate a primary function comprising a
different set of services, protocols, and daemons
that performs functions that an entity does notwant exposed to the Internet. This requirement
aims to ensure that different functions do not
impact the security profiles of other services in a
way which may cause them to operate at a higher
or lower security level.
Good Practice
Ideally, each function should be placed on
different system components. This can beachieved by implementing only one primaryfunction on each system component. Anotheroption is to isolate primary functions on the same
system component that have different security
levels, for example, isolating web servers (which
need to be directly connected to the Internet) fromapplication and database servers.
(continued on next page)

March 2022
Page 65

Requirements and Testing Procedures

Guidance
If a system component contains primary functions
that need different security levels, a third option is
to implement additional controls to ensure that theresultant security level of the primary function(s)with higher security needs is not reduced by thepresence of the lower security primary functions.
Additionally, the functions with a lower security
level should be isolated and/or secured to ensure
they cannot access or affect the resources ofanother system function, and do not introduce
security weaknesses to other functions on thesame server.
Functions of differing security levels may beisolated by either physical or logical controls. For
example, a database system should not also be
hosting web services unless using controls likevirtualization technologies to isolate and containthe functions into separate sub-systems. Anotherexample is using virtual instances or providing
dedicated memory access by system function.
Where virtualization technologies are used, thesecurity levels should be identified and managed
for each virtual component. Examples ofconsiderations for virtualized environments
include:Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

•

The function of each application, container, or
virtual server instance.

•

How virtual machines (VMs) or containers are
stored and secured.

March 2022
Page 66Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

2.2.4 Only necessary services, protocols, daemons,and functions are enabled, and all unnecessaryfunctionality is removed or disabled.

2.2.4.a Examine system configuration standards toverify necessary system services, protocols, anddaemons are identified and documented.
2.2.4.b Examine system configurations to verify thefollowing:

Customized Approach Objective•

System components cannot be compromised by
exploiting unnecessary functionality present in thesystem component.

All unnecessary functionality is removed or
disabled.

•

Only required functionality, as documented in
the configuration standards, is enabled.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeUnnecessary services and functions can provide
additional opportunities for malicious individuals
to gain access to a system. By removing or
disabling all unnecessary services, protocols,
daemons, and functions, organizations can focus
on securing the functions that are required andreduce the risk that unknown or unnecessaryfunctions will be exploited.
Good PracticeThere are many protocols that could be enabled
by default that are commonly used by malicious
individuals to compromise a network. Disabling or
removing all services, functions, and protocols
that are not used minimizes the potential attack
surface—for example, by removing or disabling
an unused FTP or web server.
ExamplesUnnecessary functionality may include, but is not
limited to scripts, drivers, features, subsystems,
file systems, interfaces (USB and Bluetooth), andunnecessary web servers.

March 2022
Page 67

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

2.2.5 If any insecure services, protocols, or
daemons are present:

2.2.5.a If any insecure services, protocols, or
daemons are present, examine system
configuration standards and interview personnel toverify they are managed and implemented inaccordance with all elements specified in thisrequirement.

•

Business justification is documented.

•

Additional security features are documented andimplemented that reduce the risk of using
insecure services, protocols, or daemons.

Customized Approach Objective
System components cannot be compromised by
exploiting insecure services, protocols, or daemons.

2.2.5.b If any insecure services, protocols, or
daemons, are present, examine configuration
settings to verify that additional security features
are implemented to reduce the risk of using
insecure services, daemons, and protocols.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeEnsuring that all insecure services, protocols, anddaemons are adequately secured withappropriate security features makes it moredifficult for malicious individuals to exploit
common points of compromise within a network.
Good PracticeEnabling security features before new systemcomponents are deployed will prevent insecure
configurations from being introduced into theenvironment. Some vendor solutions may provide
additional security functions to assist withsecuring an insecure process.
Further Information
For guidance on services, protocols, or daemonsconsidered to be insecure, refer to industry
standards and guidance (for example, as
published by NIST, ENISA, and OWASP).

March 2022
Page 68

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

2.2.6 System security parameters are configured toprevent misuse.

2.2.6.a Examine system configuration standards toverify they include configuring system security
parameters to prevent misuse.
2.2.6.b Interview system administrators and/or
security managers to verify they have knowledgeof common security parameter settings for systemcomponents.

Customized Approach Objective
System components cannot be compromised
because of incorrect security parameter
configuration.

2.2.6.c Examine system configurations to verify
that common security parameters are set
appropriately and in accordance with the system
configuration standards.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeCorrectly configuring security parametersprovided in system components takes advantageof the capabilities of the system component todefeat malicious attacks.
Good Practice
System configuration standards and related
processes should specifically address security
settings and parameters that have known security
implications for each type of system in use.
For systems to be configured securely, personnel
responsible for configuration and/or administeringsystems should be knowledgeable in the specificsecurity parameters and settings that apply to thesystem. Considerations should also include
secure settings for parameters used to accesscloud portals.
Further Information
Refer to vendor documentation and industry
references noted in Requirement 2.2.1 for
information about applicable security parameters
for each type of system.

March 2022
Page 69

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

2.2.7 All non-console administrative access isencrypted using strong cryptography.

2.2.7.a Examine system configuration standards toverify they include encrypting all non-console
administrative access using strong cryptography.
2.2.7.b Observe an administrator log on to systemcomponents and examine system configurations toverify that non-console administrative access ismanaged in accordance with this requirement.

2.2.7.c Examine settings for system components
and authentication services to verify that insecure
remote login services are not available for nonconsole administrative access.

Customized Approach Objective
Cleartext administrative authorization factors cannot
be read or intercepted from any networktransmissions.

2.2.7.d Examine vendor documentation andinterview personnel to verify that strong
cryptography for the technology in use is
implemented according to industry best practices
and/or vendor recommendations.

Applicability Notes
This includes administrative access via browserbased interfaces and application programming
interfaces (APIs).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf non-console (including remote) administration
does not use encrypted communications,administrative authorization factors (such as IDs
and passwords) can be revealed to aneavesdropper. A malicious individual could use
this information to access the network, become
administrator, and steal data.
Good Practice
Whichever security protocol is used, it should be
configured to use only secure versions andconfigurations to prevent use of an insecureconnection—for example, by using only trusted
certificates, supporting only strong encryption,and not supporting fallback to weaker, insecure
protocols or methods.
ExamplesCleartext protocols (such as HTTP, telnet, etc.) do
not encrypt traffic or logon details, making it easy
for an eavesdropper to intercept this information.
Non-console access may be facilitated bytechnologies that provide alternative access tosystems, including but not limited to, out-of-band(OOB), lights-out management (LOM), Intelligent
Platform Management Interface (IPMI), andkeyboard, video, mouse (KVM) switches withremote capabilities. These and other non-console
access technologies and methods must be
secured with strong cryptography.
Further Information
Refer to industry standards and best practices
such as NIST SP 800-52 and SP 800-57.

March 2022
Page 70

Requirements and Testing Procedures

Guidance

2.3 Wireless environments are configured and managed securely.

Defined Approach Requirements

Defined Approach Testing Procedures

2.3.1 For wireless environments connected to the
CDE or transmitting account data, all wirelessvendor defaults are changed at installation or are
confirmed to be secure, including but not limited to:

2.3.1.a Examine policies and procedures andinterview responsible personnel to verify thatprocesses are defined for wireless vendor defaults
to either change them upon installation or toconfirm them to be secure in accordance with allelements of this requirement.

•

Default wireless encryption keys.

•

Passwords on wireless access points.

•

SNMP defaults.

•

Any other security-related wireless vendor
defaults.

Customized Approach Objective
Wireless networks cannot be accessed using
vendor default passwords or default configurations.

2.3.1.b Examine vendor documentation andobserve a system administrator logging into
wireless devices to verify:•

SNMP defaults are not used.

•

Default passwords/passphrases on wirelessaccess points are not used.

PurposeIf wireless networks are not implemented with
sufficient security configurations (includingchanging default settings), wireless sniffers caneavesdrop on the traffic, easily capture data andpasswords, and easily enter and attack the
network.
Good PracticeWireless passwords should be constructed sothat they are resistant to offline brute force
attacks.

2.3.1.c Examine vendor documentation andwireless configuration settings to verify othersecurity-related wireless vendor defaults werechanged, if applicable.

Applicability Notes
This includes, but is not limited to, default wirelessencryption keys, passwords on wireless accesspoints, SNMP defaults, and any other securityrelated wireless vendor defaults.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 71Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

2.3.2 For wireless environments connected to the
CDE or transmitting account data, wirelessencryption keys are changed as follows:

2.3.2 Interview responsible personnel and examine
key-management documentation to verify thatwireless encryption keys are changed inaccordance with all elements specified in thisrequirement.

•

Whenever personnel with knowledge of the key
leave the company or the role for which theknowledge was necessary.

•

Whenever a key is suspected of or known to becompromised.

Customized Approach Objective
Knowledge of wireless encryption keys cannot allow
unauthorized access to wireless networks.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeChanging wireless encryption keys wheneversomeone with knowledge of the key leaves theorganization or moves to a role that no longer
requires knowledge of the key, helps keepknowledge of keys limited to only those with abusiness need to know.
Also, changing wireless encryption keys
whenever a key is suspected or known to becomprised makes a wireless network moreresistant to compromise.
Good PracticeThis goal can be accomplished in multiple ways,
including periodic changes of keys, changing keys
via a defined “joiners-movers-leavers” (JML)
process, implementing additional technicalcontrols, and not using fixed pre-shared keys.
In addition, any keys that are known to be, orsuspected of being, compromised should bemanaged in accordance with the entity’s incident
response plan at Requirement 12.10.1.

March 2022
Page 72

Protect Account Data
Requirement 3:

Protect Stored Account Data
Sections

3.1
3.2
3.3
3.4
3.5
3.6
3.7

Processes and mechanisms for protecting stored account data are defined and understood.
Storage of account data is kept to a minimum.
Sensitive authentication data (SAD) is not stored after authorization.
Access to displays of full PAN and ability to copy cardholder data are restricted.
Primary account number (PAN) is secured wherever it is stored.
Cryptographic keys used to protect stored account data are secured.
Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key
lifecycle are defined and implemented.
Overview

Protection methods such as encryption, truncation, masking, and hashing are critical components of account data protection. If an intruder
circumvents other security controls and gains access to encrypted account data, the data is unreadable without the proper cryptographic keys
and is unusable to that intruder. Other effective methods of protecting stored data should also be considered as potential risk-mitigation
opportunities. For example, methods for minimizing risk include not storing account data unless necessary, truncating cardholder data if full
PAN is not needed, and not sending unprotected PANs using end-user messaging technologies such as e-mail and instant messaging.
If account data is present in non-persistent memory (for example, RAM, volatile memory), encryption of account data is not required. However,proper controls must be in place to ensure that memory maintains a non-persistent state. Data should be removed from volatile memory oncethe business purpose (for example, the associated transaction) is complete. In the case that data storage becomes persistent, all applicable PCI
DSS Requirements will apply including encryption of stored data.
Requirement 3 applies to protection of stored account data unless specifically called out in an individual requirement.
Refer to Appendix G for definitions of “strong cryptography” and other PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 73Requirements and Testing Procedures

Guidance

3.1 Processes and mechanisms for protecting stored account data are defined and understood.

Defined Approach Requirements

Defined Approach Testing Procedures

3.1.1 All security policies and operational
procedures that are identified in Requirement 3 are:3.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures identified in Requirement 3
are managed in accordance with all elements
specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 3 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 3.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 3.
While it is important to define the specific policies
or procedures called out in Requirement 3, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives.

March 2022
Page 74

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.1.2 Roles and responsibilities for performing
activities in Requirement 3 are documented,
assigned, and understood.

3.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities
performing activities in Requirement 3 are
documented and assigned.

Customized Approach Objective
Day-to-day responsibilities for performing all theactivities in Requirement 3 are allocated. Personnel
are accountable for successful, continuous
operation of these requirements.

3.1.2.b Interview personnel with responsibility for
performing activities in Requirement 3 to verify thatroles and responsibilities are assigned as
documented and are understood.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, personnel may not be aware of their
day-to-day responsibilities, and critical activities
may not occur.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 75

Requirements and Testing Procedures

Guidance

3.2 Storage of account data is kept to a minimum.

Defined Approach Requirements

Defined Approach Testing Procedures

3.2.1 Account data storage is kept to a minimum
through implementation of data retention anddisposal policies, procedures, and processes that
include at least the following:

3.2.1.a Examine the data retention and disposal
policies, procedures, and processes and interview
personnel to verify processes are defined toinclude all elements specified in this requirement.

•

Coverage for all locations of stored account
data.

•

Coverage for any sensitive authentication data
(SAD) stored prior to completion of authorization.
This bullet is a best practice until its effective
date; refer to Applicability Notes below for
details.

•

Limiting data storage amount and retention timeto that which is required for legal or regulatory,
and/or business requirements.

•

Specific retention requirements for storedaccount data that defines length of retention
period and includes a documented businessjustification.

•

Processes for secure deletion or rendering
account data unrecoverable when no longer
needed per the retention policy.

•

A process for verifying, at least once every threemonths, that stored account data exceeding thedefined retention period has been securely
deleted or rendered unrecoverable.

3.2.1.b Examine files and system records on
system components where account data is stored
to verify that the data storage amount and retention
time does not exceed the requirements defined in
the data retention policy.
3.2.1.c Observe the mechanisms used to renderaccount data unrecoverable to verify data cannot
be recovered.

Customized Approach Objective
Account data is retained only where necessary andfor the least amount of time needed and is securely
deleted or rendered unrecoverable when no longer
needed.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeA formal data retention policy identifies what dataneeds to be retained, for how long, and wherethat data resides so it can be securely destroyedor deleted as soon as it is no longer needed. The
only account data that may be stored after
authorization is the primary account number or
PAN (rendered unreadable), expiration date,
cardholder name, and service code.
The storage of SAD data prior to the completionof the authorization process is also included in thedata retention and disposal policy so that storageof this sensitive data is kept to minimum, and only
retained for the defined amount of time.
Good Practice
When identifying locations of stored account data,consider all processes and personnel with accessto the data, as data could have been moved andstored in different locations than originallydefined. Storage locations that are often
overlooked include backup and archive systems,
removable data storage devices, paper-based
media, and audio recordings.
To define appropriate retention requirements, anentity first needs to understand its own businessneeds as well as any legal or regulatory
obligations that apply to its industry or to the typeof data being retained. Implementing an
automated process to ensure data is
automatically and securely deleted upon its
defined retention limit can help ensure that
account data is not retained beyond what isnecessary for business, legal, or regulatory
purposes.
(continued on next page)

March 2022
Page 76

Requirements and Testing Procedures
Applicability Notes
Where account data is stored by a TPSP (forexample, in a cloud environment), entities are
responsible for working with their service providers
to understand how the TPSP meets thisrequirement for the entity. Considerations include
ensuring that all geographic instances of a data
element are securely deleted.
The bullet above (for coverage of SAD stored prior
to completion of authorization) is a best practice
until 31 March 2025, after which it will be required
as part of Requirement 3.2.1 and must be fully
considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Methods of eliminating data when it exceeds theretention period include secure deletion tocomplete removal of the data or rendering it
unrecoverable and unable to be reconstructed.
Identifying and securely eliminating stored datathat has exceeded its specified retention period
prevents unnecessary retention of data that is nolonger needed. This process may be automated,manual, or a combination of both.
The deletion function in most operating systems is
not “secure deletion” as it allows deleted data to
be recovered, so instead, a dedicated securedeletion function or application must be used tomake data unrecoverable.
Remember, if you don't need it, don't store it!
ExamplesAn automated, programmatic procedure could be
run to locate and remove data, or a manual
review of data storage areas could be performed.
Whichever method is used, it is a good idea tomonitor the process to ensure it is completed
successfully, and that the results are recorded
and validated as being complete. Implementing
secure deletion methods ensures that the datacannot be retrieved when it is no longer needed.
Further Information
See NIST SP 800-88 Rev. 1, Guidelines forMedia Sanitization.

March 2022
Page 77

Requirements and Testing Procedures

Guidance

3.3 Sensitive authentication data (SAD) is not stored after authorization.

Defined Approach Requirements

Defined Approach Testing Procedures

3.3.1 SAD is not retained after authorization, even if
encrypted. All sensitive authentication data received
is rendered unrecoverable upon completion of theauthorization process.

3.3.1.a If SAD is received, examine documented
policies, procedures, and system configurations toverify the data is not retained after authorization.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

3.3.1.b If SAD is received, examine thedocumented procedures and observe the securedata deletion processes to verify the data isrendered unrecoverable upon completion of theauthorization process.

PurposeSAD is very valuable to malicious individuals as itallows them to generate counterfeit payment
cards and create fraudulent transactions.
Therefore, the storage of SAD upon completion of
the authorization process is prohibited.
Definitions
The authorization process completes when amerchant receives a transaction response (forexample, an approval or decline).

Applicability Notes
This requirement does not apply to issuers andcompanies that support issuing services (where
SAD is needed for a legitimate issuing businessneed) and have a business justification to store thesensitive authentication data.
Refer to Requirement 3.3.3 for additional
requirements specifically for issuers.
Sensitive authentication data includes the data citedin Requirements 3.3.1.1 through 3.3.1.3.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 78

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.3.1.1 The full contents of any track are notretained upon completion of the authorization
process.

3.3.1.1 Examine data sources to verify that the fullcontents of any track are not stored uponcompletion of the authorization process.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Applicability Notes
In the normal course of business, the following data
elements from the track may need to be retained:•

Cardholder name.

•Primary account number (PAN).

•

Expiration date.

• Service code.
To minimize risk, store securely only these data
elements as needed for business.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf full contents of any track (from the magnetic
stripe on the back of a card if present, equivalentdata contained on a chip, or elsewhere) is stored,
malicious individuals who obtain that data can use
it to reproduce payment cards and complete
fraudulent transactions.
Definitions
Full track data is alternatively called full track,
track, track 1, track 2, and magnetic-stripe data.
Each track contains a number of data elements,
and this requirement specifies only those that
may be retained post-authorization.
ExamplesData sources to review to ensure that the fullcontents of any track are not retained uponcompletion of the authorization process include,
but are not limited to:•

Incoming transaction data.

•

All logs (for example, transaction, history,
debugging, error).

•

History files.

•

Trace files.

•

Database schemas.

•

Contents of databases, and on-premise andcloud data stores.

•

Any existing memory/crash dump files.

March 2022
Page 79

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.3.1.2 The card verification code is not retained
upon completion of the authorization process.

3.3.1.2 Examine data sources, to verify that thecard verification code is not stored uponcompletion of the authorization process.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Applicability Notes
The card verification code is the three- or four-digit
number printed on the front or back of a payment
card used to verify card-not-present transactions.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf card verification code data is stolen, malicious
individuals can execute fraudulent Internet andmail-order/telephone-order (MO/TO) transactions.
Not storing this data reduces the probability of it
being compromised.
ExamplesIf card verification codes are stored on paper
media prior to completion of authorization, amethod of erasing or covering the codes should
prevent them from being read after authorizationis complete. Example methods of rendering thecodes unreadable include removing the code withscissors and applying a suitably opaque and unremovable marker over the code.
Data sources to review to ensure that the card
verification code is not retained upon completionof the authorization process include, but are notlimited to:•

Incoming transaction data.

•

All logs (for example, transaction, history,
debugging, error).

•

History files.

•

Trace files.

•

Database schemas.

•

Contents of databases, and on-premise andcloud data stores.

•

Any existing memory/crash dump files.

March 2022
Page 80Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.3.1.3 The personal identification number (PIN)
and the PIN block are not retained upon completionof the authorization process.

3.3.1.3 Examine data sources, to verify that PINs
and PIN blocks are not stored upon completion of
the authorization process.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Applicability Notes
PIN blocks are encrypted during the natural courseof transaction processes, but even if an entity
encrypts the PIN block again, it is still not allowed to
be stored after the completion of the authorization
process.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposePIN and PIN blocks should be known only to thecard owner or entity that issued the card. If thisdata is stolen, malicious individuals can execute
fraudulent PIN-based transactions (for example,
in-store purchases and ATM withdrawals). Not
storing this data reduces the probability of it being
compromised.
ExamplesData sources to review to ensure that PIN and
PIN blocks are not retained upon completion of
the authorization process include, but are notlimited to:•

Incoming transaction data.

•

All logs (for example, transaction, history,
debugging, error).

•

History files.

•

Trace files.

•

Database schemas.

•

Contents of databases, and on-premise andcloud data stores.

•

Any existing memory/crash dump files.

March 2022
Page 81Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.3.2 SAD that is stored electronically prior tocompletion of authorization is encrypted using
strong cryptography.

3.3.2 Examine data stores, system configurations,
and/or vendor documentation to verify that all SAD
that is stored electronically prior to completion of
authorization is encrypted using strong
cryptography.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Applicability Notes
Whether SAD is permitted to be stored prior toauthorization is determined by the organizations thatmanage compliance programs (for example,
payment brands and acquirers). Contact theorganizations of interest for any additional criteria.
This requirement applies to all storage of SAD, even
if no PAN is present in the environment.
Refer to Requirement 3.2.1 for an additional
requirement that applies if SAD is stored prior tocompletion of authorization.
This requirement does not apply to issuers andcompanies that support issuing services where
there is a legitimate issuing business justification to
store SAD).
Refer to Requirement 3.3.3 for requirements
specifically for issuers.
This requirement does not replace how PIN blocks
are required to be managed, nor does it mean that aproperly encrypted PIN block needs to be encryptedagain.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeSAD can be used by malicious individuals toincrease the probability of successfully generating
counterfeit payment cards and creating fraudulent
transactions.
Good Practice
Entities should consider encrypting SAD with adifferent cryptographic key than is used to encrypt
PAN. Note that this does not mean that PAN
present in SAD (as part of track data) would need
to be separately encrypted.
Definitions
The authorization process is completed as soon
as the response to an authorization request
response—that is, an approval or decline—isreceived.

March 2022
Page 82Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.3.3 Additional requirement for issuers andcompanies that support issuing services andstore sensitive authentication data: Any storageof sensitive authentication data is:3.3.3.a Additional testing procedure for issuersand companies that support issuing services
and store sensitive authentication data:
Examine documented policies and interview
personnel to verify there is a documented businessjustification for the storage of sensitive
authentication data.

•

Limited to that which is needed for a legitimate
issuing business need and is secured.

•

Encrypted using strong cryptography. Thisbullet is a best practice until its effective date;refer to Applicability Notes below for details.

Customized Approach Objective
Sensitive authentication data is retained only as
required to support issuing functions and is secured
from unauthorized access.

3.3.3.b Additional testing procedure for issuersand companies that support issuing services
and store sensitive authentication data:
Examine data stores and system configurations toverify that the sensitive authentication data isstored securely.

Applicability Notes

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeSAD can be used by malicious individuals toincrease the probability of successfully generating
counterfeit payment cards and creating fraudulent
transactions.
Good Practice
Entities should consider encrypting SAD with adifferent cryptographic key than is used to encrypt
PAN. Note that this does not mean that PAN
present in SAD (as part of track data) would need
to be separately encrypted.
Definitions
Legitimate issuing business need means that thedata is needed to facilitate the issuing businessprocess.
Further Information
Refer to ISO/DIS 9564-5 Financial services —Personal Identification Number (PIN)

March 2022
Page 83

Requirements and Testing ProceduresThis requirement applies only to issuers andcompanies that support issuing services and store
sensitive authentication data.
Entities that issue payment cards or that perform or
support issuing services will often create and control
sensitive authentication data as part of the issuing
function. It is allowable for companies that perform,
facilitate, or support issuing services to store
sensitive authentication data ONLY IF they have alegitimate business need to store such data.
PCI DSS requirements are intended for all entities
that store, process, or transmit account data,
including issuers. The only exception for issuers andissuer processors is that sensitive authentication
data may be retained if there is a legitimate reason
to do so. Any such data must be stored securely
and in accordance with all PCI DSS and specificpayment brand requirements.
The bullet above (for encrypting stored SAD withstrong cryptography) is a best practice until 31
March 2025, after which it will be required as part ofRequirement 3.3.3 and must be fully consideredduring a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
management and security — Part 5: Methods forthe generation, change, and verification of PINs
and card security data using the advanced
encryption standard.

March 2022
Page 84

Requirements and Testing Procedures

Guidance

3.4 Access to displays of full PAN and ability to copy PAN is restricted.

Defined Approach Requirements

Defined Approach Testing Procedures

3.4.1 PAN is masked when displayed (the BIN andlast four digits are the maximum number of digits
to be displayed), such that only personnel with alegitimate business need can see more than the
BIN and last four digits of the PAN.

3.4.1.a Examine documented policies andprocedures for masking the display of PANs toverify:•A list of roles that need access to more thanthe BIN and last four digits of the PAN(includes full PAN) is documented, together
with a legitimate business need for each role
to have such access.

•

PAN is masked when displayed such that only
personnel with a legitimate business need cansee more than the BIN and last four digits of
the PAN.

•All roles not specifically authorized to see thefull PAN must only see masked PANs.

Customized Approach Objective
PAN displays are restricted to the minimum numberof digits necessary to meet a defined businessneed.

Applicability Notes
This requirement does not supersede stricter
requirements in place for displays of cardholder
data—for example, legal or payment brandrequirements for point-of-sale (POS) receipts.
This requirement relates to protection of PAN where
it is displayed on screens, paper receipts, printouts,
etc., and is not to be confused with Requirement
3.5.1 for protection of PAN when stored, processed,
or transmitted.

3.4.1.b Examine system configurations to verify
that full PAN is only displayed for roles with adocumented business need, and that PAN ismasked for all other requests.
3.4.1.c Examine displays of PAN (for example, on
screen, on paper receipts) to verify that PANs aremasked when displayed, and that only those with alegitimate business need are able to see more thanthe BIN and/or last four digits of the PAN.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeThe display of full PAN on computer screens,payment card receipts, paper reports, etc. canresult in this data being obtained by unauthorizedindividuals and used fraudulently. Ensuring thatthe full PAN is displayed only for those with alegitimate business need minimizes the risk ofunauthorized persons gaining access to PAN
data.
Good Practice
Applying access controls according to definedroles is one way to limit access to viewing full
PAN to only those individuals with a definedbusiness need.
The masking approach should always display
only the number of digits needed to perform a
specific business function. For example, if only
the last four digits are needed to perform abusiness function, PAN should be masked to only
show the last four digits. As another example, if afunction needs to view to the bank identification
number (BIN) for routing purposes, unmask only
the BIN digits for that function.
Definitions
Masking is not synonymous with truncation andthese terms cannot be used interchangeably.
Masking refers to the concealment of certain
digits during display or printing, even when theentire PAN is stored on a system. This is different
from truncation, in which the truncated digits are
removed and cannot be retrieved within thesystem. Masked PAN could be “unmasked”, butthere is no "un-truncation" without recreating the
PAN from another source.
Further Information
For more information about masking andtruncation, see PCI SSC’s FAQs on these topics.
March 2022
Page 85

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.4.2 When using remote-access technologies,
technical controls prevent copy and/or relocation of
PAN for all personnel, except for those with
documented, explicit authorization and a legitimate,defined business need.

3.4.2.a Examine documented policies andprocedures and documented evidence for technicalcontrols that prevent copy and/or relocation of PAN
when using remote-access technologies onto local
hard drives or removable electronic media to verify
the following:

Customized Approach Objective
PAN cannot be copied or relocated by unauthorized
personnel using remote-access technologies.

Applicability Notes
Storing or relocating PAN onto local hard drives,
removable electronic media, and other storage
devices brings these devices into scope for PCI
DSS.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

•

Technical controls prevent all personnel not
specifically authorized from copying and/or
relocating PAN.

•

A list of personnel with permission to copy
and/or relocate PAN is maintained, together
with the documented, explicit authorization andlegitimate, defined business need.

3.4.2.b Examine configurations for remote-accesstechnologies to verify that technical controls toprevent copy and/or relocation of PAN for all
personnel, unless explicitly authorized.
3.4.2.c Observe processes and interview
personnel to verify that only personnel with
documented, explicit authorization and alegitimate, defined business need have permission
to copy and/or relocate PAN when using remoteaccess technologies.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Relocation of PAN to unauthorized storage
devices is a common way for this data to beobtained and used fraudulently.
Methods to ensure that only those with explicit
authorization and a legitimate business reason
can copy or relocate PAN minimizes the risk ofunauthorized persons gaining access to PAN.
Good Practice
Copying and relocation of PAN should only bedone to storage devices that are permissible andauthorized for that individual.
Definitions
A virtual desktop is an example of a remoteaccess technology.
Storage devices include, but are not limited to,
local hard drives, virtual drives, removable
electronic media, network drives, and cloudstorage.
Further Information
Vendor documentation for the remote-accesstechnology in use will provide information about
the system settings needed to implement thisrequirement.

March 2022
Page 86

Requirements and Testing Procedures

Guidance

3.5 Primary account number (PAN) is secured wherever it is stored.

Defined Approach Requirements

Defined Approach Testing Procedures

3.5.1 PAN is rendered unreadable anywhere it isstored by using any of the following approaches:

3.5.1.a Examine documentation about the systemused to render PAN unreadable, including thevendor, type of system/process, and the encryption
algorithms (if applicable) to verify that the PAN isrendered unreadable using any of the methods
specified in this requirement.

•

One-way hashes based on strong cryptographyof the entire PAN.

•

Truncation (hashing cannot be used to replace
the truncated segment of PAN).
– If hashed and truncated versions of thesame PAN, or different truncation formats ofthe same PAN, are present in anenvironment, additional controls are in placesuch that the different versions cannot becorrelated to reconstruct the original PAN.

•

Index tokens.

•

Strong cryptography with associated keymanagement processes and procedures.

3.5.1.b Examine data repositories and audit logs,
including payment application logs, to verify the
PAN is rendered unreadable using any of themethods specified in this requirement.
3.5.1.c If hashed and truncated versions of thesame PAN are present in the environment,
examine implemented controls to verify that thehashed and truncated versions cannot becorrelated to reconstruct the original PAN.

Customized Approach Objective
Cleartext PAN cannot be read from storage media.

Applicability Notes
It is a relatively trivial effort for a malicious individual
to reconstruct original PAN data if they have accessto both the truncated and hashed version of a PAN.
This requirement applies to PANs stored in primarystorage (databases, or flat files such as text files
spreadsheets) as well as non-primary storage(backup, audit logs, exception, or troubleshootinglogs) must all be protected.
This requirement does not preclude the use of
temporary files containing cleartext PAN while
encrypting and decrypting PAN.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Purpose
The removal of cleartext stored PAN is a defense
in depth control designed to protect the data if anunauthorized individual gains access to stored
data by taking advantage of a vulnerability or
misconfiguration of an entity’s primary access
control.
Secondary independent control systems (forexample governing access to, and use of,cryptography and decryption keys) prevent the
failure of a primary access control system leading
to a breach of confidentiality of stored PAN. Ifhashing is used to remove stored cleartext PAN,
by correlating hashed and truncated versions of agiven PAN, a malicious individual can easily
derive the original PAN value. Controls thatprevent the correlation of this data will help
ensure that the original PAN remains unreadable.
Further Information
For information about truncation formats andtruncation in general, see PCI SSC’s FAQs on the
topic.
Sources for information about index tokens
include:•PCI SSC’s Tokenization Product Security
Guidelines(https://www.pcisecuritystandards.org/docume
nts/Tokenization_Product_Security_Guidelines
.pdf)

•

ANSI X9.119-2-2017: Retail Financial Services- Requirements For Protection Of Sensitive
Payment Card Data - Part 2: Implementing
Post-Authorization Tokenization Systems

March 2022
Page 87

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.5.1.1 Hashes used to render PAN unreadable (perthe first bullet of Requirement 3.5.1) are keyed
cryptographic hashes of the entire PAN, withassociated key-management processes andprocedures in accordance with Requirements 3.6
and 3.7.

3.5.1.1.a Examine documentation about thehashing method used to render PAN unreadable,
including the vendor, type of system/process, andthe encryption algorithms (as applicable) to verify
that the hashing method results in keyed
cryptographic hashes of the entire PAN, withassociated key management processes andprocedures.

Applicability Notes

3.5.1.1.b Examine documentation about the key
management procedures and processes
associated with the keyed cryptographic hashes toverify keys are managed in accordance with
Requirements 3.6 and 3.7.

This requirement applies to PANs stored in primarystorage (databases, or flat files such as text files
spreadsheets) as well as non-primary storage(backup, audit logs, exception, or troubleshootinglogs) must all be protected.
This requirement does not preclude the use of
temporary files containing cleartext PAN while
encrypting and decrypting PAN.
This requirement is considered a best practice until
31 March 2025, after which it will be required andmust be fully considered during a PCI DSS
assessment.

3.5.1.1.c Examine data repositories to verify the
PAN is rendered unreadable.
3.5.1.1.d Examine audit logs, including payment
application logs, to verify the PAN is renderedunreadable.

Guidance
Purpose
The removal of cleartext stored PAN is a defense
in depth control designed to protect the data if anunauthorized individual gains access to stored
data by taking advantage of a vulnerability or
misconfiguration of an entity’s primary access
control.
Secondary independent control systems (forexample governing access to, and use of,cryptography and decryption keys) prevent the
failure of a primary access control system leading
to a breach of confidentiality of stored PAN.
Good Practice
A hashing function that incorporates a randomly
generated secret key provides brute force attack
resistance and secret authentication integrity.
Further Information
Appropriate keyed cryptographic hashingalgorithms include but are not limited to: HMAC,
CMAC, and GMAC, with an effective
cryptographic strength of at least 128-bits (NISTSP 800-131Ar2).
Refer to the following for more information about
HMAC, CMAC, and GMAC, respectively: NIST
SP 800-107r1, NIST SP 800-38B, and NIST SP
800-38D).
See NIST SP 800-107 (Revision 1):
Recommendation for Applications Using
Approved Hash Algorithms §5.3.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 88

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.5.1.2 If disk-level or partition-level encryption(rather than file-, column-, or field-level databaseencryption) is used to render PAN unreadable, it is
implemented only as follows:

3.5.1.2.a Examine encryption processes to verify
that, if disk-level or partition-level encryption isused to render PAN unreadable, it is implemented
only as follows:•

On removable electronic media
OR•

On removable electronic media,
OR•

If used for non-removable electronic media, PAN
is also rendered unreadable via anothermechanism that meets Requirement 3.5.1.

•

If used for non-removable electronic media,
examine encryption processes used to verify
that PAN is also rendered unreadable via
another method that meets Requirement 3.5.1.

Customized Approach Objective
This requirement is not eligible for the customized
approach.
(continued on next page)3.5.1.2.b Examine configurations and/or vendor
documentation and observe encryption processes
to verify the system is configured according tovendor documentation the result is that the disk or
the partition is rendered unreadable.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeDisk-level and partition-level encryption typicallyencrypts the entire disk or partition using thesame key, with all data automatically decrypted
when the system runs or when an authorized user
requests it. For this reason, disk-level encryption
is not appropriate to protect stored PAN on
computers, laptops, servers, storage arrays, or
any other system that provides transparent
decryption upon user authentication.
Further Information
Where available, following vendors’ hardening
and industry best practice guidelines can assist in
securing PAN on these devices.

March 2022
Page 89

Requirements and Testing Procedures

Guidance

Applicability Notes
While disk encryption may still be present on thesetypes of devices, it cannot be the only mechanism
used to protect PAN stored on those systems. Anystored PAN must also be rendered unreadable per
Requirement 3.5.1—for example, through truncation
or a data-level encryption mechanism. Full disk
encryption helps to protect data in the event ofphysical loss of a disk and therefore its use isappropriate only for removable electronic media
storage devices.
Media that is part of a data center architecture (forexample, hot-swappable drives, bulk tape-backups)
is considered non-removable electronic media towhich Requirement 3.5.1 applies.
Disk or partition encryption implementations mustalso meet all other PCI DSS encryption and keymanagement requirements.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 90

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.5.1.3 If disk-level or partition-level encryption isused (rather than file-, column-, or field--level
database encryption) to render PAN unreadable, it
is managed as follows:

3.5.1.3.a If disk-level or partition-level encryption isused to render PAN unreadable, examine thesystem configuration and observe theauthentication process to verify that logical access
is implemented in accordance with all elements
specified in this requirement.

•

Logical access is managed separately andindependently of native operating systemauthentication and access control
mechanisms.

•

Decryption keys are not associated with user
accounts.

•

Authentication factors (passwords,
passphrases, or cryptographic keys) that allow
access to unencrypted data are stored
securely.

3.5.1.3.b Examine files containing authentication
factors (passwords, passphrases, or cryptographickeys) and interview personnel to verify thatauthentication factors that allow access tounencrypted data are stored securely and are
independent from the native operating system’s
authentication and access control methods.

Customized Approach Objective

Guidance
PurposeDisk-level encryption typically encrypts the entire
disk or partition using the same key, with all data
automatically decrypted when the system runs orwhen an authorized user requests it. Many diskencryption solutions intercept operating system
read/write operations and perform the appropriate
cryptographic transformations without any special
action by the user other than supplying apassword or passphrase at system start-up or at
the beginning of a session. This provides noprotection from a malicious individual that has
already managed to gain access to a valid user
account.
Good Practice
Full disk encryption helps to protect data in theevent of physical loss of a disk and therefore its
use is best limited only to removable electronic
media storage devices.

Disk encryption implementations are configured torequire independent authentication and logicalaccess controls for decryption.

Applicability Notes
Disk or partition encryption implementations mustalso meet all other PCI DSS encryption and keymanagement requirements.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 91

Requirements and Testing Procedures

Guidance

3.6 Cryptographic keys used to protect stored account data are secured.

Defined Approach Requirements

Defined Approach Testing Procedures

3.6.1 Procedures are defined and implemented toprotect cryptographic keys used to protect storedaccount data against disclosure and misuse that
include:3.6.1 Examine documented key-management
policies and procedures to verify that processes toprotect cryptographic keys used to protect storedaccount data against disclosure and misuse aredefined to include all elements specified in thisrequirement.

•

Access to keys is restricted to the fewest numberof custodians necessary.

•

Key-encrypting keys are at least as strong as thedata-encrypting keys they protect.

•Key-encrypting keys are stored separately fromdata-encrypting keys.

•

Keys are stored securely in the fewest possible
locations and forms.

Customized Approach Objective
Processes that protect cryptographic keys used toprotect stored account data against disclosure andmisuse are defined and implemented.

PurposeCryptographic keys must be strongly protected
because those who obtain access will be able todecrypt data.
Good PracticeHaving a centralized key management system
based on industry standards is recommended for
managing cryptographic keys.
Further Information
The entity’s key management procedures will
benefit through alignment with industry
requirements, Sources for information on
cryptographic key management life cycles
include:•ISO 11568-1 Banking — Key management(retail) — Part 1: Principles (specifically
Chapter 10 and the referenced Parts 2 & 4)•

NIST SP 800-57 Part 1 Revision 5—
Recommendation for Key Management, Part
1: General.

Applicability Notes
This requirement applies to keys used to encrypt
stored account data and to key-encrypting keys
used to protect data-encrypting keys.
The requirement to protect keys used to protect
stored account data from disclosure and misuseapplies to both data-encrypting keys and keyencrypting keys. Because one key-encrypting key
may grant access to many data-encrypting keys, thekey-encrypting keys require strong protection
measures.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 92

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.6.1.1 Additional requirement for service
providers only: A documented description of thecryptographic architecture is maintained that
includes:3.6.1.1 Additional testing procedure for service
provider assessments only: Interview
responsible personnel and examine documentation
to verify that a document exists to describe thecryptographic architecture that includes allelements specified in this requirement.

•

Details of all algorithms, protocols, and keys
used for the protection of stored account data,
including key strength and expiry date.

•Preventing the use of the same cryptographic
keys in production and test environments. Thisbullet is a best practice until its effective date;refer to Applicability Notes below for details.

•

Description of the key usage for each key.

•

Inventory of any hardware security modules(HSMs), key management systems (KMS), andother secure cryptographic devices (SCDs) used
for key management, including type and locationof devices, as outlined in Requirement 12.3.4.

Customized Approach Objective
Accurate details of the cryptographic architecture
are maintained and available.

Guidance
PurposeMaintaining current documentation of thecryptographic architecture enables an entity tounderstand the algorithms, protocols, andcryptographic keys used to protect stored accountdata, as well as the devices that generate, use,and protect the keys. This allows an entity to keep
pace with evolving threats to its architecture andplan for updates as the assurance level provided
by different algorithms and key strengths
changes. Maintaining such documentation also
allows an entity to detect lost or missing keys or
key-management devices and identify
unauthorized additions to its cryptographic
architecture.
The use of the same cryptographic keys in bothproduction and test environments introduces arisk of exposing the key if the test environment is
not at the same security level as the production
environment.
Good PracticeHaving an automated reporting mechanism canassist with maintenance of the cryptographic
attributes.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.
In cloud HSM implementations, responsibility for thecryptographic architecture according to thisRequirement will be shared between the cloudprovider and the cloud customer.
The bullet above (for including, in the cryptographic
architecture, that the use of the same cryptographic
keys in production and test is prevented) is a bestpractice until 31 March 2025, after which it will be
required as part of Requirement 3.6.1.1 and mustbe fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 93Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.6.1.2 Secret and private keys used toencrypt/decrypt stored account data are stored inone (or more) of the following forms at all times:

3.6.1.2.a Examine documented procedures toverify it is defined that cryptographic keys used toencrypt/decrypt stored account data must exist
only in one (or more) of the forms specified in thisrequirement.

•

Encrypted with a key-encrypting key that is atleast as strong as the data-encrypting key, andthat is stored separately from the dataencrypting key.

•

Within a secure cryptographic device (SCD),
such as a hardware security module (HSM) or
PTS-approved point-of-interaction device.

•

As at least two full-length key components or key
shares, in accordance with an industry-accepted
method.

3.6.1.2.b Examine system configurations and key
storage locations to verify that cryptographic keys
used to encrypt/decrypt stored account data exist
in one (or more) of the forms specified in thisrequirement.
3.6.1.2.c Wherever key-encrypting keys are used,examine system configurations and key storage
locations to verify:

Customized Approach Objective•

Secret and private keys are stored in a secure form
that prevents unauthorized retrieval or access.

Key-encrypting keys are at least as strong as
the data-encrypting keys they protect.

•Key-encrypting keys are stored separately fromdata-encrypting keys.

Guidance
Purpose
Storing cryptographic keys securely prevents
unauthorized or unnecessary access that could
result in the exposure of stored account data.
Storing keys separately means they are stored
such that if the location of one key iscompromised, the second key is not also
compromised.
Good Practice
Where data-encrypting keys are stored in an
HSM, the HSM interaction channel should beprotected to prevent interception of encryption or
decryption operations.

Applicability Notes
It is not required that public keys be stored in one ofthese forms.
Cryptographic keys stored as part of a key
management system (KMS) that employs SCDs are
acceptable.
A cryptographic key that is split into two parts does
not meet this requirement. Secret or private keys
stored as key components or key shares must be
generated via one of the following:• Using an approved random number generator
and within an SCD,
OR•

According to ISO 19592 or equivalent industry
standard for generation of secret key shares.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 94Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.6.1.3 Access to cleartext cryptographic key
components is restricted to the fewest number ofcustodians necessary.

3.6.1.3 Examine user access lists to verify thataccess to cleartext cryptographic key components
is restricted to the fewest number of custodians
necessary.

Customized Approach Objective
Access to cleartext cryptographic key components
is restricted to necessary personnel.

Defined Approach Requirements

Defined Approach Testing Procedures

3.6.1.4 Cryptographic keys are stored in the fewest
possible locations.

3.6.1.4 Examine key storage locations and observe
processes to verify that keys are stored in the
fewest possible locations.

Customized Approach Objective

Guidance
PurposeRestricting the number of people who haveaccess to cleartext cryptographic key components
reduces the risk of stored account data being
retrieved or rendered visible by unauthorizedparties.
Good Practice
Only personnel with defined key custodian
responsibilities (creating, altering, rotating,
distributing, or otherwise maintaining encryptionkeys) should be granted access to key
components.
Ideally this will be a very small number of people.
Purpose
Storing any cryptographic keys in the fewest
locations helps an organization track and monitor
all key locations and minimizes the potential forkeys to be exposed to unauthorized parties.

Cryptographic keys are retained only where
necessary.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 95

Requirements and Testing Procedures

Guidance

3.7 Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle aredefined and implemented.

Defined Approach Requirements

Defined Approach Testing Procedures

3.7.1 Key-management policies and procedures are
implemented to include generation of strong
cryptographic keys used to protect stored accountdata.

3.7.1.a Examine the documented key-management
policies and procedures for keys used forprotection of stored account data to verify that they
define generation of strong cryptographic keys.
3.7.1.b Observe the method for generating keys toverify that strong keys are generated.

PurposeUse of strong cryptographic keys significantly
increases the level of security of encrypted
account data.
Further Information
See the sources referenced at "Cryptographic
Key Generation in Appendix G.

Customized Approach Objective
Strong cryptographic keys are generated.

Defined Approach Requirements

Defined Approach Testing Procedures

3.7.2 Key-management policies and procedures are
implemented to include secure distribution of
cryptographic keys used to protect stored accountdata.

3.7.2.a Examine the documented key-management
policies and procedures for keys used forprotection of stored account data to verify that they
define secure distribution of cryptographic keys.

PurposeSecure distribution or conveyance of secret or
private cryptographic keys means that keys are
distributed only to authorized custodians, as
identified in Requirement 3.6.1.2, and are neverdistributed insecurely.

3.7.2.b Observe the method for distributing keys toverify that keys are distributed securely.

Customized Approach Objective
Cryptographic keys are secured during distribution.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 96Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.7.3 Key-management policies and procedures are
implemented to include secure storage of
cryptographic keys used to protect stored accountdata.

3.7.3.a Examine the documented key-management
policies and procedures for keys used forprotection of stored account data to verify that they
define secure storage of cryptographic keys.
3.7.3.b Observe the method for storing keys toverify that keys are stored securely.

Customized Approach Objective
Cryptographic keys are secured when stored.

Defined Approach Requirements

Defined Approach Testing Procedures

3.7.4 Key management policies and procedures are
implemented for cryptographic key changes for keys
that have reached the end of their cryptoperiod, as
defined by the associated application vendor or key
owner, and based on industry best practices andguidelines, including the following:

3.7.4.a Examine the documented key-management
policies and procedures for keys used forprotection of stored account data to verify that they
define changes to cryptographic keys that havereached the end of their cryptoperiod and include
all elements specified in this requirement.

•

A defined cryptoperiod for each key type in use.

•

A process for key changes at the end of thedefined cryptoperiod.

Customized Approach Objective

3.7.4.b Interview personnel, examine
documentation, and observe key storage locations
to verify that keys are changed at the end of thedefined cryptoperiod(s).

Cryptographic keys are not used beyond theirdefined cryptoperiod.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Storing keys without proper protection could
provide access to attackers, resulting in thedecryption and exposure of account data.
Good PracticeData encryption keys can be protected byencrypting them with a key-encrypting key.
Keys can be stored in a Hardware Security
Module (HSM).
Secret or private keys that can decrypt data
should never be present in source code.
PurposeChanging encryption keys when they reach theend of their cryptoperiod is imperative to minimize
the risk of someone obtaining the encryption keys
and using them to decrypt data.
Definitions
A cryptoperiod is the time span during which a
cryptographic key can be used for its defined
purpose. Cryptoperiods are often defined in termsof the period for which the key is active and/or theamount of cipher-text that has been produced by
the key. Considerations for defining thecryptoperiod include, but are not limited to, thestrength of the underlying algorithm, size or lengthof the key, risk of key compromise, and thesensitivity of the data being encrypted.
Further Information
NIST SP 800-57 Part 1, Revision 5, Section 5.3
Cryptoperiods - provides guidance forestablishing the time span during which a specific
key is authorized for use by legitimate entities, or
the keys for a given system will remain in effect.
See Table 1 of SP 800-57 Part 1 for suggested
cryptoperiods for different key types.

March 2022
Page 97

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.7.5 Key management policies procedures are
implemented to include the retirement, replacement,
or destruction of keys used to protect storedaccount data, as deemed necessary when:

3.7.5.a Examine the documented key-management
policies and procedures for keys used forprotection of stored account data and verify thatthey define retirement, replacement, or destructionof keys in accordance with all elements specified inthis requirement.

•

The key has reached the end of its defined
cryptoperiod.

•

The integrity of the key has been weakened,
including when personnel with knowledge of acleartext key component leaves the company, or
the role for which the key component was
known.

3.7.5.b Interview personnel to verify that processes
are implemented in accordance with all elements
specified in this requirement.

The key is suspected of or known to becompromised.
Retired or replaced keys are not used for encryption
operations.
•Customized Approach Objective
Keys are removed from active use when it issuspected or known that the integrity of the key is
weakened.

Applicability Notes
If retired or replaced cryptographic keys need to beretained, these keys must be securely archived (forexample, by using a key-encryption key).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeKeys that are no longer required, keys withweakened integrity, and keys that are known orsuspected to be compromised, should bearchived, revoked, and/or destroyed to ensurethat the keys can no longer be used.
If such keys need to be kept (for example, tosupport archived encrypted data), they should bestrongly protected.
Good PracticeArchived cryptographic keys should be used only
for decryption/verification purposes.
The encryption solution should provide for andfacilitate a process to replace keys that are due
for replacement or that are known to be, orsuspected of being, compromised. In addition,
any keys that are known to be, or suspected ofbeing, compromised should be managed inaccordance with the entity’s incident response
plan per Requirement 12.10.1.
Further Information
Industry best practices for archiving retired keys
are outlined in NIST SP 800-57 Part 1, Revision
5, Section 8.3.1, and includes maintaining thearchive with a trusted third party and storingarchived key information separately fromoperational data.

March 2022
Page 98

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.7.6 Where manual cleartext cryptographic keymanagement operations are performed bypersonnel, key-management policies andprocedures are implemented include managing
these operations using split knowledge and dual
control.

3.7.6.a Examine the documented key-management
policies and procedures for keys used forprotection of stored account data and verify thatthey define using split knowledge and dual control.

Customized Approach Objective

3.7.6.b Interview personnel and/or observe
processes to verify that manual cleartext keys aremanaged with split knowledge and dual control.

Cleartext secret or private keys cannot be known byanyone. Operations involving cleartext keys cannot
be carried out by a single person.

Applicability Notes
This control is applicable for manual keymanagement operations or where key management
is not controlled by the encryption product.
A cryptographic key that is simply split into two parts
does not meet this requirement. Secret or private
keys stored as key components or key shares mustbe generated via one of the following:• Using an approved random number generator
and within a secure cryptographic device (SCD),
such as a hardware security module (HSM) or
PTS-approved point-of-interaction device,OR• According to ISO 19592 or equivalent industry
standard for generation of secret key shares.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeSplit knowledge and dual control of keys are used
to eliminate the possibility of a single person
having access to the whole key and therefore
being able to gain unauthorized access to thedata.
Definitions
Split knowledge is a method in which two or more
people separately have key components, where
each person knows only their own key
component, and the individual key components
convey no knowledge of other components or of
the original cryptographic key.
Dual control requires two or more people toauthenticate the use of a cryptographic key or
perform a key-management function. No single
person can access or use the authentication
factor (for example, the password, PIN, or key) of
another.
Good Practice
Where key components or key shares are used,
procedures should ensure that no single
custodian ever has access to sufficient key
components or shares to reconstruct thecryptographic key. For example, in an m-of-nscheme (for example, Shamir), where only two of
any three components are required to reconstruct
the cryptographic key, a custodian must not havecurrent or prior knowledge of more than one
component. If a custodian was previously
assigned component A, which was thenreassigned, the custodian should not then be
assigned component B or C, as this would givethe custodian knowledge of two components andthe ability to recreate the key.
(continued on next page)

March 2022
Page 99

Requirements and Testing Procedures

Guidance
ExamplesKey-management operations that might beperformed manually include, but are not limited to,
key generation, transmission, loading, storage,
and destruction.
Further Information
Industry standards for managing key components
include:Defined Approach Requirements

Defined Approach Testing Procedures

3.7.7 Key management policies and procedures are
implemented to include the prevention ofunauthorized substitution of cryptographic keys.

3.7.7.a Examine the documented key-management
policies and procedures for keys used forprotection of stored account data and verify thatthey define prevention of unauthorized substitutionof cryptographic keys.
3.7.7.b Interview personnel and/or observe
processes to verify that unauthorized substitutionof keys is prevented.

Customized Approach Objective
Cryptographic keys cannot be substituted byunauthorized personnel.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

•

NIST SP 800-57 Part 2, Revision 1 -Recommendation for Key Management: Part 2– Best Practices for Key Management
Organizations [4.6 Keying Material
Distribution]•

ISO 11568-2 Banking — Key management(retail) — Part 2: Symmetric ciphers, their key
management and life cycle [4.7.2.3 Key
components and 4.9.3 Key components]•

European Payments Council EPC342-08
Guidelines on Cryptographic Algorithms
Usage and Key Management [especially 4.1.4
Key installation].

PurposeIf an attacker is able to substitute an entity’s key
with a key the attacker knows, the attacker will beable to decrypt all data encrypted with that key.
Good Practice
The encryption solution should not allow for or
accept substitution of keys from unauthorized
sources or unexpected processes.
Controls should include ensuring that individuals
with access to key components or shares do nothave access to other components or shares thatform the necessary threshold to derive the key.

March 2022
Page 100Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

3.7.8 Key management policies and procedures are
implemented to include that cryptographic key
custodians formally acknowledge (in writing orelectronically) that they understand and accept their
key-custodian responsibilities.

3.7.8.a Examine the documented key-management
policies and procedures for keys used forprotection of stored account data and verify thatthey define acknowledgments for key custodians inaccordance with all elements specified in thisrequirement.

Customized Approach Objective

3.7.8.b Examine documentation or other evidence
showing that key custodians have provided
acknowledgments in accordance with all elements
specified in this requirement.

Key custodians are knowledgeable about their
responsibilities in relation to cryptographic
operations and can access assistance and guidance
when required.

Defined Approach Requirements

Defined Approach Testing Procedures

3.7.9 Additional requirement for service
providers only: Where a service provider shares
cryptographic keys with its customers fortransmission or storage of account data, guidanceon secure transmission, storage and updating ofsuch keys is documented and distributed to theservice provider’s customers.

3.7.9 Additional testing procedure for service
provider assessments only: If the service
provider shares cryptographic keys with its
customers for transmission or storage of accountdata, examine the documentation that the service
provider provides to its customers to verify it
includes guidance on how to securely transmit,
store, and update customers’ keys in accordancewith all elements specified in Requirements 3.7.1
through 3.7.8 above.

Customized Approach Objective
Customers are provided with appropriate key
management guidance whenever they receive
shared cryptographic keys.

Guidance
PurposeThis process will help ensure individuals that act
as key custodians commit to the key-custodianrole and understand and accept the
responsibilities. An annual reaffirmation can help
remind key custodians of their responsibilities.
Further Information
Industry guidance for key custodians and theirroles and responsibilities includes:•

NIST SP 800-130 A Framework for Designing
Cryptographic Key Management Systems [5.
Roles and Responsibilities (especially) for Key
Custodians]•

ISO 11568-1 Banking -- Key management(retail) -- Part 1: Principles [5 Principles of key
management (especially b)]

Purpose
Providing guidance to customers on how tosecurely transmit, store, and update cryptographic
keys can help prevent keys from being
mismanaged or disclosed to unauthorized
entities.
Further Information
Numerous industry standards for key
management are cited above in the Guidance for
Requirements 3.7.1-3.7.8.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 101

Requirement 4:
Networks

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public
Sections

4.1
4.2

Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks aredefined and documented.
PAN is protected with strong cryptography during transmission
Overview

The use of strong cryptography provides greater assurance in preserving data confidentiality, integrity, and non-repudiation.
To protect against compromise, PAN must be encrypted during transmission over networks that are easily accessed by malicious individuals,
including untrusted and public networks. Misconfigured wireless networks and vulnerabilities in legacy encryption and authentication protocols
continue to be targeted by malicious individuals aiming to exploit these vulnerabilities to gain privileged access to cardholder data environments(CDE). Any transmissions of cardholder data over an entity’s internal network(s) will naturally bring that network into scope for PCI DSS sincethat network stores, processes, or transmits cardholder data. Any such networks must be evaluated and assessed against applicable PCI DSS
requirements.
Requirement 4 applies to transmissions of PAN unless specifically called out in an individual requirement.
PAN transmissions can be protected by encrypting the data before it is transmitted, or by encrypting the session over which the data istransmitted, or both. While it is not required that strong cryptography be applied at both the data level and the session level, it is recommended.
Refer to Appendix G for definitions of “strong cryptography” and other PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 102

Requirements and Testing Procedures

Guidance

4.1 Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks are defined anddocumented.

Defined Approach Requirements

Defined Approach Testing Procedures

4.1.1 All security policies and operational
procedures that are identified in Requirement 4 are:4.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures identified in Requirement 4
are managed in accordance with all elements
specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 4 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 4.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 4.
While it is important to define the specific policies
or procedures called out in Requirement 4, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives. Policies and procedures, including
updates, are actively communicated to all affected
personnel, and are supported by operatingprocedures describing how to perform activities.

March 2022
Page 103Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

4.1.2 Roles and responsibilities for performing
activities in Requirement 4 are documented,
assigned, and understood.

4.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 4 are
documented and assigned.
4.1.2.b Interview personnel with responsibility for
performing activities in Requirement 4 to verify thatroles and responsibilities are assigned as
documented and are understood.

Customized Approach Objective
Day-to-day responsibilities for performing all theactivities in Requirement 4 are allocated. Personnel
are accountable for successful, continuous
operation of these requirements.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, personnel may not be aware of their
day-to-day responsibilities and critical activities
may not occur.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 104

Requirements and Testing Procedures

Guidance

4.2 PAN is protected with strong cryptography during transmission.

Defined Approach Requirements

Defined Approach Testing Procedures

4.2.1 Strong cryptography and security protocols
are implemented as follows to safeguard PAN
during transmission over open, public networks:

4.2.1.a Examine documented policies andprocedures and interview personnel to verify
processes are defined to include all elements
specified in this requirement.

•

Only trusted keys and certificates are accepted.

•

Certificates used to safeguard PAN duringtransmission over open, public networks are
confirmed as valid and are not expired or
revoked. This bullet is a best practice until its
effective date; refer to applicability notes below
for details.

•

The protocol in use supports only secureversions or configurations and does not support
fallback to, or use of insecure versions,algorithms, key sizes, or implementations.

•

The encryption strength is appropriate for theencryption methodology in use.

4.2.1.b Examine system configurations to verify
that strong cryptography and security protocols are
implemented in accordance with all elements
specified in this requirement.
4.2.1.c Examine cardholder data transmissions toverify that all PAN is encrypted with strong
cryptography when it is transmitted over open,
public networks.
4.2.1.d Examine system configurations to verify
that keys and/or certificates that cannot be verified
as trusted are rejected.

Customized Approach Objective
Cleartext PAN cannot be read or intercepted fromany transmissions over open, public networks.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeSensitive information must be encrypted duringtransmission over public networks because it iseasy and common for a malicious individual tointercept and/or divert data while in transit.
Good Practice
The network and data-flow diagrams defined in
Requirement 1 are useful resources for identifying
all connection points where account data istransmitted or received over open, public
networks.
While not required, it is considered a goodpractice for entities to also encrypt PAN over theirinternal networks, and for entities to establish any
new network implementations with encrypted
communications.
PAN transmissions can be protected byencrypting the data before it is transmitted, or by
encrypting the session over which the data istransmitted, or both. While it is not required thatstrong cryptography be applied at both the data
level and the session level, it is strongly
recommended. If encrypted at the data level, thecryptographic keys used for protecting the data
can be managed in accordance with
Requirements 3.6 and 3.7. If the data is encryptedat the session level, designated key custodiansshould be assigned responsibility for managing
transmission keys and certificates.
(continued on next page)

March 2022
Page 105Requirements and Testing Procedures
Applicability Notes
There could be occurrences where an entity
receives cardholder data unsolicited via an insecurecommunication channel that was not intended forthe purpose of receiving sensitive data. In thissituation, the entity can choose to either include thechannel in the scope of their CDE and secure it
according to PCI DSS or implement measures toprevent the channel from being used for cardholder
data.
A self-signed certificate may also be acceptable if
the certificate is issued by an internal CA within theorganization, the certificate’s author is confirmed,
and the certificate is verified—for example, via hashor signature—and has not expired. Note that selfsigned certificates where the Distinguished Name
(DN) field in the “issued by” and “issued to” field isthe same are not acceptable.
The bullet above (for confirming that certificatesused to safeguard PAN during transmission overopen, public networks are valid and are not expiredor revoked) is a best practice until 31 March 2025,
after which it will be required as part of Requirement
4.2.1 and must be fully considered during a PCI
DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Some protocol implementations (such as SSL,
SSH v1.0, and early TLS) have known
vulnerabilities that an attacker can use to gain
access to the cleartext data. It is critical that
entities maintain awareness of industry-defined
deprecation dates for the cipher suites they areusing and are prepared to migrate to newer
versions or protocols when older ones are nolonger deemed secure.
Verifying that certificates are trusted helps ensure
the integrity of the secure connection. To beconsidered trusted, a certificate should be issued
from a trusted source, such as a trusted certificate
authority (CA), and not be expired. Up-to-dateCertificate Revocation Lists (CRLs) or Online
Certificate Status Protocol (OCSP) can be used tovalidate certificates.
Techniques to validate certificates may include
certificate and public key pinning, where thetrusted certificate or a public key is pinned either
during development or upon its first use. Entities
can also confirm with developers or review sourcecode to ensure that clients and servers rejectconnections if the certificate is bad.
For browser-based TLS certificates, certificate
trust can often be verified by clicking on the lockicon that appears next to the address bar.
(continued on next page)

March 2022
Page 106Requirements and Testing Procedures

Guidance
ExamplesOpen, public networks include, but are not limited
to:•

The Internet andWireless technologies, including Wi-Fi,
Bluetooth, cellular technologies, and satellite
communications.
Further Information
Vendor recommendations and industry bestpractices can be consulted for information about
the proper encryption strength specific to theencryption methodology in use.
For more information about strong cryptography
and secure protocols, see industry standards andbest practices such as NIST SP 800-52 and SP
800-57.

•

For more information about trusted keys andcertificates, see NIST Cybersecurity Practice
Guide Special Publication 1800-16, Securing Web
Transactions: Transport Layer Security (TLS)
Server Certificate Management.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 107

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

4.2.1.1 An inventory of the entity’s trusted keys andcertificates used to protect PAN during transmission
is maintained.

4.2.1.1.a Examine documented policies andprocedures to verify processes are defined for theentity to maintain an inventory of its trusted keys
and certificates.

Customized Approach Objective

4.2.1.1.b Examine the inventory of trusted keys
and certificates to verify it is kept up to date.

All keys and certificates used to protect PAN duringtransmission are identified and confirmed as trusted.

Guidance
PurposeThe inventory of trusted keys helps the entity
keep track of the algorithms, protocols, key
strength, key custodians, and key expiry dates.
This enables the entity to respond quickly tovulnerabilities discovered in encryption software,certificates, and cryptographic algorithms.
Good PracticeFor certificates, the inventory should include theissuing CA and certification expiration date.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 108

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

4.2.1.2 Wireless networks transmitting PAN orconnected to the CDE use industry best practices toimplement strong cryptography for authenticationand transmission.

4.2.1.2 Examine system configurations to verify
that wireless networks transmitting PAN orconnected to the CDE use industry best practices
to implement strong cryptography forauthentication and transmission.

Customized Approach Objective
Cleartext PAN cannot be read or intercepted fromwireless network transmissions.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeSince wireless networks do not require physicalmedia to connect, it is important to establish
controls limiting who can connect and what
transmission protocols will be used. Malicious
users use free and widely available tools toeavesdrop on wireless communications. Use ofstrong cryptography can help limit disclosure ofsensitive information across wireless networks.
Wireless networks present unique risks to anorganization; therefore, they must be identified
and protected according to industry requirements.
Strong cryptography for authentication andtransmission of PAN is required to prevent
malicious users from gaining access to thewireless network or utilizing wireless networks toaccess other internal networks or data.
Good PracticeWireless networks should not permit fallback or
downgrade to an insecure protocol or lower
encryption strength that does not meet the intent
of strong cryptography.
Further Information
Review the vendor’s specific documentation for
more details on the choice of protocols,configurations, and settings related to
cryptography.

March 2022
Page 109

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

4.2.2 PAN is secured with strong cryptography
whenever it is sent via end-user messaging
technologies.

4.2.2.a Examine documented policies andprocedures to verify that processes are defined tosecure PAN with strong cryptography wheneversent over end-user messaging technologies.

Customized Approach Objective
Cleartext PAN cannot be read or intercepted fromtransmissions using end-user messaging
technologies.

4.2.2.b Examine system configurations and vendor
documentation to verify that PAN is secured withstrong cryptography whenever it is sent via enduser messaging technologies.

Guidance
PurposeEnd-user messaging technologies typically can beeasily intercepted by packet-sniffing during
delivery across internal and public networks.
Good Practice
The use of end-user messaging technology tosend PAN should only be considered where there
is a defined business need.
ExamplesE-mail, instant messaging, SMS, and chat are
examples of the type of end-user messaging
technology that this requirement refers to.

Applicability Notes
This requirement also applies if a customer, or otherthird-party, requests that PAN is sent to them via
end-user messaging technologies.
There could be occurrences where an entity
receives unsolicited cardholder data via an insecurecommunication channel that was not intended fortransmissions of sensitive data. In this situation, theentity can choose to either include the channel inthe scope of their CDE and secure it according to
PCI DSS or delete the cardholder data andimplement measures to prevent the channel frombeing used for cardholder data.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 110

Maintain a Vulnerability Management Program
Requirement 5:

Protect All Systems and Networks from Malicious Software
Sections

5.1
5.2
5.3
5.4

Processes and mechanisms for protecting all systems and networks from malicious software are defined and understood.
Malicious software (malware) is prevented, or detected and addressed.
Anti-malware mechanisms and processes are active, maintained, and monitored.
Anti-phishing mechanisms protect users against phishing attacks.
Overview

Malicious software (malware) is software or firmware designed to infiltrate or damage a computer system without the owner's knowledge orconsent, with the intent of compromising the confidentiality, integrity, or availability of the owner’s data, applications, or operating system.
Examples include viruses, worms, Trojans, spyware, ransomware, keyloggers, and rootkits, malicious code, scripts, and links.
Malware can enter the network during many business-approved activities, including employee e-mail (for example, via phishing) and use of theInternet, mobile computers, and storage devices, resulting in the exploitation of system vulnerabilities.
Using anti-malware solutions that address all types of malware helps to protect systems from current and evolving malware threats.
Refer to Appendix G for definitions of PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 111

Requirements and Testing Procedures

Guidance

5.1 Processes and mechanisms for protecting all systems and networks from malicious software are defined and understood.

Defined Approach Requirements

Defined Approach Testing Procedures

5.1.1 All security policies and operational
procedures that are identified in Requirement 5 are:5.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures identified in Requirement 5
are managed in accordance with all elements
specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 5 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 5.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 5.
While it is important to define the specific policies
or procedures called out in Requirement 5, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives.

March 2022
Page 112

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

5.1.2 Roles and responsibilities for performing
activities in Requirement 5 are documented,
assigned, and understood.

5.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 5 are
documented and assigned.

Customized Approach Objective

5.1.2.b Interview personnel with responsibility for
performing activities in Requirement 5 to verify thatroles and responsibilities are assigned as
documented and are understood.

Day-to-day responsibilities for performing all theactivities in Requirement 5 are allocated. Personnel
are accountable for successful, continuous
operation of these requirements.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, networks and systems may not beproperly protected from malware.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

5.2 Malicious software (malware) is prevented, or detected and addressed.

Defined Approach Requirements

Defined Approach Testing Procedures

5.2.1 An anti-malware solution(s) is deployed on all
system components, except for those systemcomponents identified in periodic evaluations per
Requirement 5.2.3 that concludes the systemcomponents are not at risk from malware.

5.2.1.a Examine system components to verify thatan anti-malware solution(s) is deployed on all
system components, except for those determined
to not be at risk from malware based on periodic
evaluations per Requirement 5.2.3.

Customized Approach Objective

5.2.1.b For any system components without ananti-malware solution, examine the periodic
evaluations to verify the component was evaluatedand the evaluation concludes that the component
is not at risk from malware.

Automated mechanisms are implemented to prevent
systems from becoming an attack vector for
malware.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeThere is a constant stream of attacks targeting
newly discovered vulnerabilities in systems
previously regarded as secure. Without an antimalware solution that is updated regularly, newforms of malware can be used to attack systems,
disable a network, or compromise data.
Good Practice
It is beneficial for entities to be aware of "zeroday" attacks (those that exploit a previously
unknown vulnerability) and consider solutions that
focus on behavioral characteristics and will alert
and react to unexpected behavior.
Definitions
System components known to be affected bymalware have active malware exploits available in
the real world (not only theoretical exploits).

March 2022
Page 113

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

5.2.2 The deployed anti-malware solution(s):5.2.2 Examine vendor documentation andconfigurations of the anti-malware solution(s) toverify that the solution:•

Detects all known types of malware.

•

Removes, blocks, or contains all known types of
malware.

•Detects all known types of malware.

•

Removes, blocks, or contains all known typesof malware.

Customized Approach Objective
Malware cannot execute or infect other systemcomponents.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIt is important to protect against all types andforms of malware to prevent unauthorized access.
Good PracticeAnti-malware solutions may include a combinationof network-based controls, host-based controls,and endpoint security solutions. In addition tosignature-based tools, capabilities used bymodern anti-malware solutions include
sandboxing, privilege escalation controls, andmachine learning.
Solution techniques include preventing malware
from getting into the network and removing or
containing malware that does get into the
network.
Examples
Types of malware include, but are not limited to,viruses, Trojans, worms, spyware, ransomware,
keyloggers, rootkits, malicious code, scripts, andlinks.

March 2022
Page 114

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

5.2.3 Any system components that are not at risk formalware are evaluated periodically to include thefollowing:

5.2.3.a Examine documented policies andprocedures to verify that a process is defined for
periodic evaluations of any system componentsthat are not at risk for malware that includes allelements specified in this requirement.

•

A documented list of all system components not
at risk for malware.

•

Identification and evaluation of evolving
malware threats for those system components.

•

Confirmation whether such system components
continue to not require anti-malware protection.

Customized Approach Objective

5.2.3.b Interview personnel to verify that theevaluations include all elements specified in thisrequirement.
5.2.3.c Examine the list of system components
identified as not at risk of malware and compare to
the system components without an anti-malware
solution deployed per Requirement 5.2.1 to verify
that the system components match for both
requirements.

The entity maintains awareness of evolving malware
threats to ensure that any systems not protectedfrom malware are not at risk of infection.

Applicability Notes
System components covered by this requirement
are those for which there is no anti-malware solution
deployed per Requirement 5.2.1.

Guidance
PurposeCertain systems, at a given point in time, may notcurrently be commonly targeted or affected bymalware. However, industry trends for malware
can change quickly, so it is important fororganizations to be aware of new malware thatmight affect their systems—for example, bymonitoring vendor security notices and antimalware forums to determine whether its systems
might be coming under threat from new andevolving malware.
Good Practice
If an entity determines that a particular system is
not susceptible to any malware, the determination
should be supported by industry evidence, vendor
resources, and best practices.
The following steps can help entities during theirperiodic evaluations:•

Identification of all system types previously
determined to not require malware protection.

•

Review of industry vulnerability alerts andnotices to determine if new threats exist for
any identified system.

•

A documented conclusion about whether thesystem types remain not susceptible tomalware.

A strategy to add malware protection for any
system types for which malware protection has
become necessary.
Trends in malware should be included in theidentification of new security vulnerabilities at
Requirement 6.3.1, and methods to address new
trends should be incorporated into the entity’s
configuration standards and protection
mechanisms as needed.

•

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 115

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

5.2.3.1 The frequency of periodic evaluations ofsystem components identified as not at risk formalware is defined in the entity’s targeted risk
analysis, which is performed according to allelements specified in Requirement 12.3.1.

5.2.3.1.a Examine the entity’s targeted risk
analysis for the frequency of periodic evaluationsof system components identified as not at risk formalware to verify the risk analysis was performedin accordance with all elements specified in
Requirement 12.3.1.

Customized Approach Objective
Systems not known to be at risk from malware are
re-evaluated at a frequency that addresses theentity’s risk.

Guidance
PurposeEntities determine the optimum period toundertake the evaluation based on criteria suchas the complexity of each entity’s environment
and the number of types of systems that are
required to be evaluated.

5.2.3.1.b Examine documented results of periodic
evaluations of system components identified as not
at risk for malware and interview personnel toverify that evaluations are performed at thefrequency defined in the entity’s targeted risk
analysis performed for this requirement.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 116Requirements and Testing Procedures

Guidance

5.3 Anti-malware mechanisms and processes are active, maintained, and monitored.

Defined Approach Requirements

Defined Approach Testing Procedures

5.3.1 The anti-malware solution(s) is kept current
via automatic updates.

5.3.1.a Examine anti-malware solution(s)configurations, including any master installation of
the software, to verify the solution is configured toperform automatic updates.

Customized Approach Objective

5.3.1.b Examine system components and logs, toverify that the anti-malware solution(s) anddefinitions are current and have been promptly
deployed

Anti-malware mechanisms can detect and address
the latest malware threats.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeFor an anti-malware solution to remain effective, itneeds to have the latest security updates,
signatures, threat analysis engines, and any othermalware protections on which the solution relies.
Having an automated update process avoids
burdening end users with responsibility for
manually installing updates and provides greater
assurance that anti-malware protection
mechanisms are updated as quickly as possible
after an update is released.
Good PracticeAnti-malware mechanisms should be updated via
a trusted source as soon as possible after an
update is available. Using a trusted common
source to distribute updates to end-user systems
helps ensure the integrity and consistency of thesolution architecture.
Updates may be automatically downloaded to acentral location—for example, to allow for
testing—prior to being deployed to individual
system components.

March 2022
Page 117

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

5.3.2 The anti-malware solution(s):5.3.2.a Examine anti-malware solution(s)configurations, including any master installation of
the software, to verify the solution(s) is configured
to perform at least one of the elements specified inthis requirement.

•

Performs periodic scans and active or real-timescans.
OR•

Performs continuous behavioral analysis ofsystems or processes.

Customized Approach Objective
Malware cannot complete execution.

5.3.2.b Examine system components, including all
operating system types identified as at risk formalware, to verify the solution(s) is enabled inaccordance with at least one of the elements
specified in this requirement.
5.3.2.c Examine logs and scan results to verify thatthe solution(s) is enabled in accordance with atleast one of the elements specified in thisrequirement.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Periodic scans can identify malware that ispresent, but currently inactive, within theenvironment. Some malware, such as zero-day
malware, can enter an environment before thescan solution is capable of detecting it.
Performing regular periodic scans or continuous
behavioral analysis of systems or processes
helps ensure that previously undetectablemalware can be identified, removed, andinvestigated to determine how it gained access tothe environment.
Good PracticeUsing a combination of periodic scans (scheduled
and on-demand) and active, real-time (on-access)scanning helps ensure that malware residing inboth static and dynamic elements of the CDE isaddressed. Users should also be able to run ondemand scans on their systems if suspicious
activity is detected – this can be useful in theearly detection of malware.
Scans should include the entire file system,
including all disks, memory, and start-up files andboot records (at system restart) to detect all
malware upon file execution, including any
software that may be resident on a system but not
currently active. Scan scope should include allsystems and software in the CDE, including thosethat are often overlooked such as email servers,
web browsers, and instant messaging software.
Definitions
Active, or real-time, scanning checks files formalware upon any attempt to open, close,
rename, or otherwise interact with a file,
preventing the malware from being activated.

March 2022
Page 118

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

5.3.2.1 If periodic malware scans are performed tomeet Requirement 5.3.2, the frequency of scans isdefined in the entity’s targeted risk analysis, whichis performed according to all elements specified in
Requirement 12.3.1.

5.3.2.1.a Examine the entity’s targeted risk
analysis for the frequency of periodic malware
scans to verify the risk analysis was performed inaccordance with all elements specified in
Requirement 12.3.1.

Guidance
PurposeEntities can determine the optimum period toundertake periodic scans based on their own
assessment of the risks posed to theirenvironments.

5.3.2.1.b Examine documented results of periodic
malware scans and interview personnel to verify
scans are performed at the frequency defined in
the entity’s targeted risk analysis performed for thisrequirement.

Customized Approach Objective
Scans by the malware solution are performed at afrequency that addresses the entity’s risk.

Applicability Notes
This requirement applies to entities conducting
periodic malware scans to meet Requirement 5.3.2.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 119

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

5.3.3 For removable electronic media, the antimalware solution(s):5.3.3.a Examine anti-malware solution(s)configurations to verify that, for removable
electronic media, the solution is configured toperform at least one of the elements specified inthis requirement.

•

Performs automatic scans of when the media isinserted, connected, or logically mounted,
OR•

Performs continuous behavioral analysis ofsystems or processes when the media isinserted, connected, or logically mounted.

Customized Approach Objective
Malware cannot be introduced to systemcomponents via external removable media.

Guidance
PurposePortable media devices are often overlooked as
an entry method for malware. Attackers will often
pre-load malware onto portable devices such as
USB and flash drives; connecting an infected
device to a computer then triggers the malware,
introducing new threats within the environment.

5.3.3.b Examine system components withremovable electronic media connected to verify
that the solution(s) is enabled in accordance withat least one of the elements as specified in thisrequirement.
5.3.3.c Examine logs and scan results to verify thatthe solution(s) is enabled in accordance with atleast one of the elements specified in thisrequirement.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Defined Approach Requirements

Defined Approach Testing Procedures

5.3.4 Audit logs for the anti-malware solution(s) areenabled and retained in accordance with
Requirement 10.5.1.

5.3.4 Examine anti-malware solution(s)configurations to verify logs are enabled andretained in accordance with Requirement 10.5.1.

Customized Approach Objective
Historical records of anti-malware actions are
immediately available and retained for at least 12
months.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeIt is important to track the effectiveness of theanti-malware mechanisms—for example, byconfirming that updates and scans are being
performed as expected, and that malware is
identified and addressed. Audit logs also allow anentity to determine how malware entered theenvironment and track its activity when inside theentity’s network.

March 2022
Page 120

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

5.3.5 Anti-malware mechanisms cannot be disabledor altered by users, unless specifically documented,
and authorized by management on a case-by-casebasis for a limited time period.

5.3.5.a Examine anti-malware configurations, toverify that the anti-malware mechanisms cannot bedisabled or altered by users.

Customized Approach Objective

5.3.5.b Interview responsible personnel andobserve processes to verify that any requests todisable or alter anti-malware mechanisms are
specifically documented and authorized bymanagement on a case-by-case basis for a limited
time period.

Anti-malware mechanisms cannot be modified byunauthorized personnel.

Applicability Notes
Anti-malware solutions may be temporarily disabled
only if there is a legitimate technical need, as
authorized by management on a case-by-casebasis. If anti-malware protection needs to bedisabled for a specific purpose, it must be formallyauthorized. Additional security measures may alsoneed to be implemented for the period during whichanti-malware protection is not active.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIt is important that defensive mechanisms arealways running so that malware is detected in realtime. Ad-hoc starting and stopping of antimalware solutions could allow malware topropagate unchecked and undetected.
Good Practice
Where there is a legitimate need to temporarily
disable a system’s anti-malware protection—for
example, to support a specific maintenanceactivity or investigation of a technical problem—
the reason for taking such action should beunderstood and approved by an appropriate
management representative. Any disabling oraltering of anti-malware mechanisms, including on
administrators’ own devices, should be performedby authorized personnel. It is recognized thatadministrators have privileges that may allow
them to disable anti-malware on their own
computers, but there should be alerting
mechanisms in place when such software isdisabled and then follow up that occurs to ensure
correct processes were followed.
ExamplesAdditional security measures that may need to be
implemented for the period during which antimalware protection is not active include
disconnecting the unprotected system from theInternet while the anti-malware protection isdisabled and running a full scan once it is reenabled.

March 2022
Page 121

Requirements and Testing Procedures

Guidance

5.4 Anti-phishing mechanisms protect users against phishing attacks.

Defined Approach Requirements

Defined Approach Testing Procedures

5.4.1 Processes and automated mechanisms are inplace to detect and protect personnel against
phishing attacks.

5.4.1 Observe implemented processes andexamine mechanisms to verify controls are in place
to detect and protect personnel against phishingattacks.

Customized Approach Objective
Mechanisms are in place to protect against andmitigate risk posed by phishing attacks.

Applicability Notes
This requirement applies to the automatedmechanism. It is not intended that the systems andservices providing such automated mechanisms(such as email servers) are brought into scope for
PCI DSS.
The focus of this requirement is on protecting
personnel with access to system components inscope for PCI DSS.
Meeting this requirement for technical andautomated controls to detect and protect personnel
against phishing is not the same as Requirement
12.6.3.1 for security awareness training. Meeting
this requirement does not also meet the requirement
for providing personnel with security awarenesstraining, and vice versa.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeTechnical controls can limit the number ofoccasions personnel have to evaluate the veracityof a communication and can also limit the effects
of individual responses to phishing.
Good Practice
When developing anti-phishing controls, entities
are encouraged to consider a combination of
approaches. For example, using anti-spoofing
controls such as Domain-based Message
Authentication, Reporting & Conformance(DMARC), Sender Policy Framework (SPF), andDomain Keys Identified Mail (DKIM) will help stop
phishers from spoofing the entity’s domain andimpersonating personnel.
The deployment of technologies for blocking
phishing emails and malware before they reachpersonnel, such as link scrubbers and server-side
anti-malware, can reduce incidents and decrease
the time required by personnel to check andreport phishing attacks. Additionally, training
personnel to recognize and report phishing emails
can allow similar emails to be identified andpermit them to be removed before being opened.
It is recommended (but not required) that antiphishing controls are applied across an entity’s
entire organization.
(continued on next page)

March 2022
Page 122

Requirements and Testing Procedures

Guidance
Definitions
Phishing is a form of social engineering anddescribes the different methods used by attackers
to trick personnel into disclosing sensitive
information, such as user account names andpasswords, and account data. Attackers will
typically disguise themselves and attempt toappear as a genuine or trusted source, directing
personnel to send an email response, click on a
web link, or enter data into a compromised
website. Mechanisms that can detect and prevent
phishing attempts are often included in antimalware solutions.
Further Information
See the following for more information aboutphishing:
National Cyber Security Centre - Phishing
Attacks: Defending your Organization.
US Cybersecurity & Infrastructure Security
Agency - Report Phishing Sites.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 123

Requirement 6:

Develop and Maintain Secure Systems and Software
Sections

6.1
6.2
6.3
6.4
6.5

Processes and mechanisms for developing and maintaining secure systems and software are defined and understood.
Bespoke and custom software are developed securely.
Security vulnerabilities are identified and addressed.
Public-facing web applications are protected against attacks.
Changes to all system components are managed securely.
Overview

Actors with bad intentions can use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor
provided security patches, which must be installed by the entities that manage the systems. All system components must have all appropriate
software patches to protect against the exploitation and compromise of account data by malicious individuals and malicious software.
Appropriate software patches are those patches that have been evaluated and tested sufficiently to determine that the patches do not conflictwith existing security configurations. For bespoke and custom software, numerous vulnerabilities can be avoided by applying software lifecycle(SLC) processes and secure coding techniques.
Code repositories that store application code, system configurations, or other configuration data that can impact the security of account data or
the CDE are in scope for PCI DSS assessments.
See Relationship between PCI DSS and PCI SSC Software Standards on page 7 for information about the use of PCI SSC-validated softwareand software vendors, and how use of PCI SSC’s software standards may help with meeting controls in Requirement 6.
Refer to Appendix G for definitions of PCI DSS terms.
Note: Requirement 6 applies to all system components, except for section 6.2 for developing software securely, which applies only to bespokeand custom software used on any system component included in or connected to the CDE.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 124

Requirements and Testing Procedures

Guidance

6.1 Processes and mechanisms for developing and maintaining secure systems and software are defined and understood.

Defined Approach Requirements

Defined Approach Testing Procedures

6.1.1 All security policies and operational
procedures that are identified in Requirement 6 are:6.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures identified in Requirement 6
are managed in accordance with all elements
specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 6 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 6.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 6.
While it is important to define the specific policies
or procedures called out in Requirement 6, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives.

March 2022
Page 125Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.1.2 Roles and responsibilities for performing
activities in Requirement 6 are documented,
assigned, and understood.

6.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 6 are
documented and assigned.

Customized Approach Objective
Day-to-day responsibilities for performing all theactivities in Requirement 6 are allocated. Personnel
are accountable for successful, continuous
operation of these requirements.

6.1.2.b Interview personnel responsible for
performing activities in Requirement 6 to verify thatroles and responsibilities are assigned as
documented and are understood.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, systems will not be securely
maintained, and their security level will be
reduced.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 126

Requirements and Testing Procedures

Guidance

6.2 Bespoke and custom software are developed securely.

Defined Approach Requirements

Defined Approach Testing Procedures

6.2.1 Bespoke and custom software are developed
securely, as follows:

6.2.1 Examine documented software development
procedures to verify that processes are definedthat include all elements specified in thisrequirement.

•

Based on industry standards and/or bestpractices for secure development.

•

In accordance with PCI DSS (for example,
secure authentication and logging).

•

Incorporating consideration of information
security issues during each stage of the softwaredevelopment lifecycle.

Customized Approach Objective
Bespoke and custom software is developed inaccordance with PCI DSS and secure development
processes throughout the software lifecycle.

Applicability Notes
This applies to all software developed for or by theentity for the entity’s own use. This includes both
bespoke and custom software. This does not apply
to third-party software.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeWithout the inclusion of security during therequirements definition, design, analysis, andtesting phases of software development, security
vulnerabilities can be inadvertently or maliciously
introduced into the production environment.
Good Practice
Understanding how sensitive data is handled by
the application—including when stored,transmitted, and in memory—can help identify
where data needs to be protected.
PCI DSS requirements must be considered whendeveloping software to meet those requirements
by design, rather than trying to retrofit thesoftware later.
ExamplesSecure software lifecycle management
methodologies and frameworks include PCI
Software Security Framework, BSIMM,
OPENSAMM, and works from NIST, ISO, and
SAFECode.

March 2022
Page 127

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.2.2 Software development personnel working on
bespoke and custom software are trained at least
once every 12 months as follows:

6.2.2.a Examine software development proceduresto verify that processes are defined for training ofsoftware development personnel developing
bespoke and custom software that includes allelements specified in this requirement.

•

On software security relevant to their job function
and development languages.

•

Including secure software design and secure
coding techniques.

•

Including, if security testing tools are used, how
to use the tools for detecting vulnerabilities insoftware.

Customized Approach Objective

6.2.2.b Examine training records and interview
personnel to verify that software development
personnel working on bespoke and custom
software received software security training that isrelevant to their job function and development
languages in accordance with all elements
specified in this requirement.

Software development personnel remainknowledgeable about secure development
practices; software security; and attacks against thelanguages, frameworks, or applications they
develop. Personnel are able to access assistanceand guidance when required.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeHaving staff knowledgeable in secure coding
methods, including techniques defined in
Requirement 6.2.4, will help minimize the numberof security vulnerabilities introduced through poor
coding practices.
Good PracticeTraining for developers may be provided in-houseor by third parties.
Training should include, but is not limited to,development languages in use, secure software
design, secure coding techniques, use oftechniques/methods for finding vulnerabilities incode, processes to prevent reintroducing
previously resolved vulnerabilities, and how to
use any automated security testing tools for
detecting vulnerabilities in software.
As industry-accepted secure coding practices
change, organizational coding practices anddeveloper training may need to be updated toaddress new threats.

March 2022
Page 128

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.2.3 Bespoke and custom software is reviewed
prior to being released into production or tocustomers, to identify and correct potential coding
vulnerabilities, as follows:

6.2.3.a Examine documented softwaredevelopment procedures and interview responsible
personnel to verify that processes are defined that
require all bespoke and custom software to bereviewed in accordance with all elements specified
in this requirement.

•

Code reviews ensure code is developed
according to secure coding guidelines.

•

Code reviews look for both existing andemerging software vulnerabilities.

•

Appropriate corrections are implemented prior torelease.

6.2.3.b Examine evidence of changes to bespokeand custom software to verify that the codechanges were reviewed in accordance with allelements specified in this requirement.

Customized Approach Objective
Bespoke and custom software cannot be exploited
via coding vulnerabilities.

Applicability Notes
This requirement for code reviews applies to all
bespoke and custom software (both internal andpublic-facing), as part of the system development
lifecycle.
Public-facing web applications are also subject toadditional controls, to address ongoing threats andvulnerabilities after implementation, as defined at
PCI DSS Requirement 6.4.
Code reviews may be performed using either
manual or automated processes, or a combinationof both.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeSecurity vulnerabilities in bespoke and custom
software are commonly exploited by malicious
individuals to gain access to a network andcompromise account data.
Vulnerable code is far more difficult andexpensive to address after it has been deployedor released into production environments.
Requiring a formal review and signoff bymanagement prior to release helps to ensure thatcode is approved and has been developed inaccordance with policies and procedures.
Good Practice
The following items should be considered forinclusion in code reviews:•

Searching for undocumented features (implant
tools, backdoors).

•

Confirming that software securely uses
external components’ functions (libraries,
frameworks, APIs, etc.). For example, if athird-party library providing cryptographic
functions is used, verify that it was integrated
securely.

•

Checking for correct use of logging to prevent
sensitive data from getting into logs.

•

Analysis of insecure code structures that may
contain potential vulnerabilities related tocommon software attacks identified in
Requirements 6.2.5.

•

Checking the application’s behavior to detect
logical vulnerabilities.

March 2022
Page 129

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.2.3.1 If manual code reviews are performed for
bespoke and custom software prior to release to
production, code changes are:

6.2.3.1.a If manual code reviews are performed for
bespoke and custom software prior to release to
production, examine documented softwaredevelopment procedures and interview responsible
personnel to verify that processes are defined for
manual code reviews to be conducted inaccordance with all elements specified in thisrequirement.

•

Reviewed by individuals other than theoriginating code author, and who areknowledgeable about code-review techniquesand secure coding practices.

•

Reviewed and approved by management prior torelease.

Customized Approach Objective
The manual code review process cannot be
bypassed and is effective at discovering security
vulnerabilities.

6.2.3.1.b Examine evidence of changes tobespoke and custom software and interview
personnel to verify that manual code reviews wereconducted in accordance with all elements
specified in this requirement.

Applicability Notes
Manual code reviews can be conducted byknowledgeable internal personnel or knowledgeable
third-party personnel.
An individual that has been formally granted
accountability for release control and who is neither
the original code author nor the code reviewer fulfills
the criteria of being management.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeHaving code reviewed by someone other than theoriginal author, who is both experienced in code
reviews and knowledgeable about secure coding
practices, minimizes the possibility that code
containing security or logic errors that could affectthe security of cardholder data is released into a
production environment. Requiring management
approval that the code was reviewed limits theability for the process to be bypassed.
Good PracticeHaving a formal review methodology and review
checklists has been found to improve the qualityof the code review process.
Code review is a tiring process, and for thisreason, it is most effective when reviewers only
review small amounts of code at a time.
To maintain the effectiveness of code reviews, it
is beneficial to monitor the general workload ofreviewers and to have them review applications
they are familiar with.
Code reviews may be performed using either
manual or automated processes, or a
combination of both.
Entitles that rely solely on manual code review
should ensure that reviewers maintain their skills
through regular training as new vulnerabilities arefound, and new secure coding methods arerecommended.
Further Information
See the OWASP Code Review Guide.

March 2022
Page 130

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.2.4 Software engineering techniques or othermethods are defined and in use by softwaredevelopment personnel to prevent or mitigate
common software attacks and related vulnerabilities
in bespoke and custom software, including but notlimited to the following:

6.2.4 Examine documented procedures andinterview responsible software development
personnel to verify that software engineering
techniques or other methods are defined and inuse by developers of bespoke and custom
software to prevent or mitigate all common
software attacks as specified in this requirement.

•

Injection attacks, including SQL, LDAP, XPath,or other command, parameter, object, fault, or
injection-type flaws.

•

Attacks on data and data structures, including
attempts to manipulate buffers, pointers, input
data, or shared data.

•

Attacks on cryptography usage, including
attempts to exploit weak, insecure, orinappropriate cryptographic implementations,algorithms, cipher suites, or modes of operation.

•

Attacks on business logic, including attempts toabuse or bypass application features andfunctionalities through the manipulation of APIs,
communication protocols and channels, clientside functionality, or other system/application
functions and resources. This includes cross-site
scripting (XSS) and cross-site request forgery(CSRF).

•

Attacks on access control mechanisms, including
attempts to bypass or abuse identification,authentication, or authorization mechanisms, orattempts to exploit weaknesses in theimplementation of such mechanisms.

•

Attacks via any “high-risk” vulnerabilities
identified in the vulnerability identification
process, as defined in Requirement 6.3.1.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Detecting or preventing common errors that resultin vulnerable code as early as possible in thesoftware development process lowers theprobability that such errors make it through to
production and lead to a compromise. Having
formal engineering techniques and tools
embedded in the development process will catchthese errors early. This philosophy is sometimes
called “shifting security left.”
Good PracticeFor both bespoke and custom software, the entity
must ensure that code is developed focusing on
the prevention or mitigation of common software
attacks, including:•Attempts to exploit common coding
vulnerabilities (bugs).

•

Attempts to exploit software design flaws.

•

Attempts to exploit
implementation/configuration flaws.

Enumeration attacks – automated attacks thatare actively exploited in payments and abuse
identification, authentication, or authorization
mechanisms. See the PCI Perspectives blog
article “Beware of Account Testing Attacks.”
Researching and documenting software
engineering techniques or other methods helps todefine how software developers prevent or
mitigate various software attacks by features orcountermeasures they build into software. Thismight include identification/authentication
mechanisms, access control, input validation
routines, etc. Developers should be familiar withdifferent types of vulnerabilities and potential
attacks and use measures to avoid potential
attack vectors when developing code.
(continued on next page)•

March 2022
Page 131

Requirements and Testing Procedures
Customized Approach Objective
Bespoke and custom software cannot be exploited
via common attacks and related vulnerabilities.

Guidance
ExamplesTechniques include automated processes andpractices that scan code early in the development
cycle when code is checked in to confirm thevulnerabilities are not present.

Applicability Notes
This applies to all software developed for or by theentity for the entity’s own use. This includes both
bespoke and custom software. This does not apply
to third-party software.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 132

Requirements and Testing Procedures

Guidance

6.3 Security vulnerabilities are identified and addressed.

Defined Approach Requirements

Defined Approach Testing Procedures

6.3.1 Security vulnerabilities are identified andmanaged as follows:

6.3.1.a Examine policies and procedures for
identifying and managing security vulnerabilities toverify that processes are defined in accordancewith all elements specified in this requirement.

•

New security vulnerabilities are identified using
industry-recognized sources for security
vulnerability information, including alerts frominternational and national computer emergency
response teams (CERTs).

•

Vulnerabilities are assigned a risk ranking basedon industry best practices and consideration ofpotential impact.

•

Risk rankings identify, at a minimum, allvulnerabilities considered to be a high-risk or
critical to the environment.

•

Vulnerabilities for bespoke and custom, andthird-party software (for example operating
systems and databases) are covered.

6.3.1.b Interview responsible personnel, examine
documentation, and observe processes to verify
that security vulnerabilities are identified andmanaged in accordance with all elements specified
in this requirement.

Customized Approach Objective
New system and software vulnerabilities that may
impact the security of account data or the CDE aremonitored, cataloged, and risk assessed.

Applicability Notes
This requirement is not achieved by, nor is it thesame as, vulnerability scans performed for
Requirements 11.3.1 and 11.3.2. This requirement
is for a process to actively monitor industry sources
for vulnerability information and for the entity todetermine the risk ranking to be associated witheach vulnerability.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeClassifying the risks (for example, as critical, high,medium, or low) allows organizations to identify,
prioritize, and address the highest risk items more
quickly and reduce the likelihood thatvulnerabilities posing the greatest risk will be
exploited.
Good Practice
Methods for evaluating vulnerabilities andassigning risk ratings will vary based on anorganization’s environment and risk-assessment
strategy.
When an entity is assigning its risk rankings, it
should consider using a formal, objective,
justifiable methodology that accurately portrays
the risks of the vulnerabilities pertinent to theorganization and translates to an appropriate
entity-assigned priority for resolution.
An organization’s processes for managing
vulnerabilities should be integrated with othermanagement processes—for example, risk
management, change management, patch
management, incident response, application
security, as well as proper monitoring and logging
of these processes. This will help to ensure allvulnerabilities are properly identified andaddressed. Processes should support ongoingevaluation of vulnerabilities. For example, avulnerability initially identified as low risk could
become a higher risk later. Additionally,
vulnerabilities, individually considered to be low or
medium risk, could collectively pose a high orcritical risk if present on the same system, or if
exploited on a low-risk system that could result inaccess to the CDE.
(continued on next page)

March 2022
Page 133

Requirements and Testing Procedures

Guidance
ExamplesSome organizations that issue alerts to advise
entities about urgent vulnerabilities requiring
immediate patches/updates are national
Computer Emergency Readiness/Response
Teams (CERTs) and vendors.
Criteria for ranking vulnerabilities may include
criticality of a vulnerability identified in an alert
from Forum of Incident Response and Security
Teams (FIRST) or a CERT, consideration of the
CVSS score, the classification by the vendor,
and/or type of systems affected.
Further Information
Trustworthy sources for vulnerability information
include vendor websites, industry newsgroups,
mailing lists, etc. If software is developed inhouse, the internal development team should also
consider sources of information about newvulnerabilities that may affect internally developed
applications. Other methods to ensure newvulnerabilities are identified include solutions that
automatically recognize and alert upon detectionof unusual behavior. Processes should accountfor widely published exploits as well as “zero-day”
attacks, which target previously unknown
vulnerabilities.
For bespoke and custom software, theorganization may obtain information about
libraries, frameworks, compilers, programming
languages, etc. from public trusted sources (forexample, special resources and resources fromcomponent developers). The organization may
also independently analyze third-party
components and identify vulnerabilities.
(continued on next page)

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 134

Requirements and Testing Procedures

Guidance
For control over in-house developed software, theorganization may receive such information fromexternal sources. The organization can consider
using a “bug bounty” program where it posts
information (for example, on its website) so third
parties can contact the organization withvulnerability information. External sources may
include independent investigators or companies
that report to the organization about identified
vulnerabilities and may include sources such as
the Common Vulnerability Scoring System(CVSS) or the OWASP Risk Rating Methodology.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 135

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.3.2 An inventory of bespoke and custom software,and third-party software components incorporated
into bespoke and custom software is maintained tofacilitate vulnerability and patch management.

6.3.2.a Examine documentation and interview
personnel to verify that an inventory of bespokeand custom software and third-party software
components incorporated into bespoke and custom
software is maintained, and that the inventory isused to identify and address vulnerabilities.

Customized Approach Objective
Known vulnerabilities in third-party software
components cannot be exploited in bespoke andcustom software.

6.3.2.b Examine software documentation, including
for bespoke and custom software that integrates
third-party software components, and compare it to
the inventory to verify that the inventory includes
the bespoke and custom software and third-party
software components.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIdentifying and listing all the entity’s bespoke andcustom software, and any third-party software thatis incorporated into the entity’s bespoke andcustom software enables the entity to manage
vulnerabilities and patches.
Vulnerabilities in third-party components(including libraries, APIs, etc.) embedded in an
entity’s software also renders those applications
vulnerable to attacks. Knowing which third-party
components are used in the entity’s software andmonitoring the availability of security patches toaddress known vulnerabilities is critical toensuring the security of the software.
Good PracticeAn entity’s inventory should cover all payment
software components and dependencies,
including supported execution platforms orenvironments, third-party libraries, services, andother required functionalities.
There are many different types of solutions that
can help with managing software inventories,
such as software composition analysis tools,
application discovery tools, and mobile device
management.

March 2022
Page 136

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.3.3 All system components are protected fromknown vulnerabilities by installing applicablesecurity patches/updates as follows:

6.3.3.a Examine policies and procedures to verify
processes are defined for addressing
vulnerabilities by installing applicable security
patches/updates in accordance with all elements
specified in this requirement.

••

Critical or high-security patches/updates(identified according to the risk ranking process
at Requirement 6.3.1) are installed within one
month of release.
All other applicable security patches/updates are
installed within an appropriate time frame asdetermined by the entity (for example, within
three months of release).

6.3.3.b Examine system components and related
software and compare the list of installed security
patches/updates to the most recent security
patch/update information to verify vulnerabilities
are addressed in accordance with all elements
specified in this requirement.

Customized Approach Objective
System components cannot be compromised via
the exploitation of a known vulnerability.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeNew exploits are constantly being discovered,and these can permit attacks against systems thathave previously been considered secure. If themost recent security patches/updates are not
implemented on critical systems as soon as
possible, a malicious actor can use these exploits
to attack or disable a system or gain access tosensitive data.
Good PracticePrioritizing security patches/updates for criticalinfrastructure ensures that high-priority systems
and devices are protected from vulnerabilities assoon as possible after a patch is released.
An entity’s patching cadence should factor in any
re-evaluation of vulnerabilities and subsequentchanges in the criticality of a vulnerability per
Requirement 6.3.1. For example, a vulnerability
initially identified as low risk could become ahigher risk later. Additionally, vulnerabilities
individually considered to be low or medium risk
could collectively pose a high or critical risk if
present on the same system, or if exploited on a
low-risk system that could result in access to the
CDE.

March 2022
Page 137

Requirements and Testing Procedures

Guidance

6.4 Public-facing web applications are protected against attacks.

Defined Approach Requirements

Defined Approach Testing Procedures

6.4.1 For public-facing web applications, newthreats and vulnerabilities are addressed on an
ongoing basis and these applications are protectedagainst known attacks as follows:

6.4.1 For public-facing web applications, ensurethat either one of the required methods is in place
as follows:

Reviewing public-facing web applications via
manual or automated application vulnerability
security assessment tools or methods as follows:– At least once every 12 months and after
significant changes.
– By an entity that specializes in application
security.
– Including, at a minimum, all common
software attacks in Requirement 6.2.4.
– All vulnerabilities are ranked in accordancewith requirement 6.3.1.
– All vulnerabilities are corrected.
– The application is re-evaluated after thecorrections
OR

•

•

•

If manual or automated vulnerability security
assessment tools or methods are in use,
examine documented processes, interview
personnel, and examine records of application
security assessments to verify that public-facing
web applications are reviewed in accordancewith all elements of this requirement specific to
the tool/method.

OR•

If an automated technical solution(s) is installedthat continually detects and prevents webbased attacks, examine the system
configuration settings and audit logs, andinterview responsible personnel to verify thatthe automated technical solution(s) is installedin accordance with all elements of thisrequirement specific to the solution(s).

Installing an automated technical solution(s) that
continually detects and prevents web-based
attacks as follows:– Installed in front of public-facing web
applications to detect and prevent webbased attacks.
– Actively running and up to date as
applicable.
– Generating audit logs.
– Configured to either block web-based
attacks or generate an alert that is
immediately investigated.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposePublic-facing web applications are those that areavailable to the public (not only for internal use).
These applications are primary targets for
attackers, and poorly coded web applications
provide an easy path for attackers to gain accessto sensitive data and systems.
Good PracticeManual or automated vulnerability security
assessment tools or methods review and/or test
the application for vulnerabilities.
Common assessment tools include specialized
web scanners that perform automatic analysis of
web application protection.
When using automated technical solutions, it isimportant to include processes that facilitate
timely responses to alerts generated by thesolutions so that any detected attacks can be
mitigated.
ExamplesA web application firewall (WAF) installed in frontof public-facing web applications to check all
traffic is an example of an automated technicalsolution that detects and prevents web-based
attacks (for example, the attacks included in
Requirement 6.2.4). WAFs filter and block nonessential traffic at the application layer. A properly
configured WAF helps to prevent application-layer
attacks on applications that are improperly coded
or configured.
(continued on next page)

March 2022
Page 138

Requirements and Testing Procedures
Customized Approach Objective
Public-facing web applications are protected against
malicious attacks.

Applicability Notes
This assessment is not the same as the vulnerabilityscans performed for Requirement 11.3.1 and11.3.2.
This requirement will be superseded byRequirement 6.4.2 after 31 March 2025 when
Requirement 6.4.2 becomes effective.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Another example of an automated technicalsolution is Runtime Application Self-Protection(RASP) technologies. When implemented
correctly, RASP solutions can detect and blockanomalous behavior by the software duringexecution. While WAFs typically monitor theapplication perimeter, RASP solutions monitor
and block behavior within the application.

March 2022
Page 139

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.4.2 For public-facing web applications, anautomated technical solution is deployed that
continually detects and prevents web-based attacks,
with at least the following:

6.4.2 For public-facing web applications, examine
the system configuration settings and audit logs,
and interview responsible personnel to verify that
an automated technical solution that detects andprevents web-based attacks is in place inaccordance with all elements specified in thisrequirement.

•

Is installed in front of public-facing web
applications and is configured to detect andprevent web-based attacks.

•

Actively running and up to date as applicable.

•

Generating audit logs.

•

Configured to either block web-based attacks or
generate an alert that is immediately
investigated.

Customized Approach Objective
Public-facing web applications are protected in realtime against malicious attacks.

Applicability Notes
This new requirement will replace Requirement
6.4.1 once its effective date is reached.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposePublic-facing web applications are primary targets
for attackers, and poorly coded web applications
provide an easy path for attackers to gain accessto sensitive data and systems.
Good Practice
When using automated technical solutions, it isimportant to include processes that facilitate
timely responses to alerts generated by thesolutions so that any detected attacks can be
mitigated. Such solutions may also be used toautomate mitigation, for example rate-limiting
controls, which can be implemented to mitigate
against brute-force attacks and enumeration
attacks.
ExamplesA web application firewall (WAF), which can beeither on-premise or cloud-based, installed in
front of public-facing web applications to check all
traffic, is an example of an automated technicalsolution that detects and prevents web-based
attacks (for example, the attacks included in
Requirement 6.2.4). WAFs filter and block nonessential traffic at the application layer. A properly
configured WAF helps to prevent application-layer
attacks on applications that are improperly coded
or configured.

March 2022
Page 140

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.4.3 All payment page scripts that are loaded andexecuted in the consumer’s browser are managed
as follows:

6.4.3.a Examine policies and procedures to verify
that processes are defined for managing all
payment page scripts that are loaded andexecuted in the consumer’s browser, in
accordance with all elements specified in thisrequirement.

•

A method is implemented to confirm that eachscript is authorized.

•

A method is implemented to assure the integrityof each script.

•

An inventory of all scripts is maintained withwritten justification as to why each is necessary.

6.4.3.b Interview responsible personnel andexamine inventory records and system
configurations to verify that all payment page
scripts that are loaded and executed in the
consumer’s browser are managed in accordancewith all elements specified in this requirement.

Customized Approach Objective
Unauthorized code cannot be present in thepayment page as it is rendered in the consumer’sbrowser.

Applicability Notes
This requirement applies to all scripts loaded fromthe entity’s environment and scripts loaded fromthird and fourth parties.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeScripts loaded and executed in the payment page
can have their functionality altered without theentity’s knowledge and can also have thefunctionality to load additional external scripts (forexample, advertising and tracking, tag
management systems).
Such seemingly harmless scripts can be used bypotential attackers to upload malicious scripts thatcan read and exfiltrate cardholder data from theconsumer browser.
Ensuring that the functionality of all such scripts isunderstood to be necessary for the operation of
the payment page minimizes the number ofscripts that could be tampered with.
Ensuring that scripts have been explicitly
authorized reduces the probability of unnecessary
scripts being added to the payment page without
appropriate management approval.
Using techniques to prevent tampering with thescript will minimize the probability of the script
being modified to carry out unauthorized
behavior, such as skimming the cardholder datafrom the payment page.
Good Practice
Scripts may be authorized by manual or
automated (e.g., workflow) processes.
Where the payment page will be loaded into an
inline frame (IFRAME), restricting the location thatthe payment page can be loaded from, using theparent page’s Content Security Policy (CSP) can
help prevent unauthorized content being
substituted for the payment page.
(continued on next page)

March 2022
Page 141

Requirements and Testing Procedures

Guidance
Definitions“Necessary” for this requirement means that theentity’s review of each script justifies and confirms
why it is needed for the functionality of thepayment page to accept a payment transaction.
ExamplesThe integrity of scripts can be enforced by several
different mechanisms including, but not limited to:

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

•

Sub-resource integrity (SRI), which allows theconsumer browser to validate that a script has
not been tampered with.

•

A CSP, which limits the locations theconsumer browser can load a script from andtransmit account data to.

•

Proprietary script or tag-management
systems, which can prevent malicious script
execution.

March 2022
Page 142

Requirements and Testing Procedures

Guidance

6.5 Changes to all system components are managed securely.

Defined Approach Requirements

Defined Approach Testing Procedures

6.5.1 Changes to all system components in the
production environment are made according toestablished procedures that include:

6.5.1.a Examine documented change control
procedures to verify procedures are defined forchanges to all system components in the
production environment to include all elements
specified in this requirement.

•

Reason for, and description of, the change.

•

Documentation of security impact.

•

Documented change approval by authorizedparties.

•

Testing to verify that the change does notadversely impact system security.

•

For bespoke and custom software changes, all
updates are tested for compliance with
Requirement 6.2.4 before being deployed into
production.

•

Procedures to address failures and return to asecure state.

6.5.1.b Examine recent changes to systemcomponents and trace those changes back torelated change control documentation. For eachchange examined, verify the change is
implemented in accordance with all elements
specified in this requirement.

Customized Approach Objective
All changes are tracked, authorized, and evaluatedfor impact and security, and changes are managed
to avoid unintended effects to the security of systemcomponents.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeChange management procedures must be
applied to all changes—including the addition,
removal, or modification of any systemcomponent—in the production environment. It is
important to document the reason for a change
and the change description so that relevant
parties understand and agree the change isneeded. Likewise, documenting the impacts of thechange allows all affected parties to plan
appropriately for any processing changes.
Good PracticeApproval by authorized parties confirms that thechange is legitimate and that the change issanctioned by the organization. Changes should
be approved by individuals with the appropriate
authority and knowledge to understand the impactof the change.
Thorough testing by the entity confirms that the
security of the environment is not reduced by
implementing a change and that all existing
security controls either remain in place or are
replaced with equal or stronger security controls
after the change. The specific testing to be
performed will vary according to the type ofchange and system component(s) affected.
For each change, it is important to havedocumented procedures that address any failures
and provide instructions on how to return to asecure state in case the change fails or adversely
affects the security of an application or system.
These procedures will allow the application orsystem to be restored to its previous secure state.

March 2022
Page 143

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.5.2 Upon completion of a significant change, allapplicable PCI DSS requirements are confirmed to
be in place on all new or changed systems andnetworks, and documentation is updated as
applicable.

6.5.2 Examine documentation for significant
changes, interview personnel, and observe theaffected systems/networks to verify that the entity
confirmed applicable PCI DSS requirements werein place on all new or changed systems andnetworks and that documentation was updated as
applicable.

Customized Approach Objective
All system components are verified after asignificant change to be compliant with theapplicable PCI DSS requirements.

Applicability Notes
These significant changes should also be captured
and reflected in the entity’s annual PCI DSS scope
confirmation activity per Requirement 12.5.2.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeHaving processes to analyze significant changes
helps ensure that all appropriate PCI DSS
controls are applied to any systems or networks
added or changed within the in-scope
environment, and that PCI DSS requirements
continue to be met to secure the environment.
Good Practice
Building this validation into change management
processes helps ensure that device inventories
and configuration standards are kept up to dateand security controls are applied where needed.
ExamplesApplicable PCI DSS requirements that could be
impacted include, but are not limited to:•

Network and data-flow diagrams are updated
to reflect changes.

•

Systems are configured per configuration
standards, with all default passwords changed
and unnecessary services disabled.

•

Systems are protected with required
controls—for example, file integrity monitoring(FIM), anti-malware, patches, and audit
logging.

•

Sensitive authentication data is not stored, andall account data storage is documented andincorporated into data retention policy andprocedures.

•

New systems are included in the quarterly
vulnerability scanning process.

•

Systems are scanned for internal and external
vulnerabilities after significant changes per
Requirements 11.3.1.3 and 11.3.2.1.

March 2022
Page 144

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.5.3 Pre-production environments are separated
from production environments and the separation isenforced with access controls.

6.5.3.a Examine policies and procedures to verify
that processes are defined for separating the preproduction environment from the production
environment via access controls that enforce theseparation.
6.5.3.b Examine network documentation andconfigurations of network security controls to verify
that the pre-production environment is separate
from the production environment(s).

Customized Approach Objective
Pre-production environments cannot introduce risks
and vulnerabilities into production environments.

6.5.3.c Examine access control settings to verify
that access controls are in place to enforce
separation between the pre-production andproduction environment(s).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeDue to the constantly changing state of preproduction environments, they are often lesssecure than the production environment.
Good Practice
Organizations must clearly understand which
environments are test environments ordevelopment environments and how theseenvironments interact on the level of networks
and applications.
Definitions
Pre-production environments include
development, testing, user acceptance testing(UAT), etc. Even where production infrastructureis used to facilitate testing or development,
production environments still need to be
separated (logically or physically) from preproduction functionality such that vulnerabilities
introduced as a result of pre-production activities
do not adversely affect production systems.

March 2022
Page 145

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.5.4 Roles and functions are separated between
production and pre-production environments toprovide accountability such that only reviewed andapproved changes are deployed.

6.5.4.a Examine policies and procedures to verify
that processes are defined for separating roles andfunctions to provide accountability such that only
reviewed and approved changes are deployed.

Customized Approach Objective

6.5.4.b Observe processes and interview
personnel to verify implemented controls separate
roles and functions and provide accountability suchthat only reviewed and approved changes are
deployed.

Job roles and accountability that differentiate
between pre-production and production activities
are defined and managed to minimize the risk ofunauthorized, unintentional, or inappropriate
actions.

Applicability Notes
In environments with limited personnel whereindividuals perform multiple roles or functions, thissame goal can be achieved with additional
procedural controls that provide accountability. For
example, a developer may also be an administrator
that uses an administrator-level account withelevated privileges in the development environment
and, for their developer role, they use a separate
account with user-level access to the production
environment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeThe goal of separating roles and functions
between production and pre-production
environments is to reduce the number of
personnel with access to the production
environment and account data and thereby
minimize risk of unauthorized, unintentional, or
inappropriate access to data and systemcomponents and help ensure that access islimited to those individuals with a business needfor such access.
The intent of this control is to separate criticalactivities to provide oversight and review to catcherrors and minimize the chances of fraud or theft(since two people would need to collude in orderto hide an activity).
Separating roles and functions, also referred to as
separation or segregation of duties, is a key
internal control concept to protect an entity’s
assets.

March 2022
Page 146

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.5.5 Live PANs are not used in pre-production
environments, except where those environments
are included in the CDE and protected inaccordance with all applicable PCI DSS
requirements.

6.5.5.a Examine policies and procedures to verify
that processes are defined for not using live PANs
in pre-production environments, except where
those environments are in a CDE and protected inaccordance with all applicable PCI DSS
requirements.
6.5.5.b Observe testing processes and interview
personnel to verify procedures are in place toensure live PANs are not used in pre-production
environments, except where those environments
are in a CDE and protected in accordance with allapplicable PCI DSS requirements.

Customized Approach Objective
Live PANs cannot be present in pre-production
environments outside the CDE.

6.5.5.c Examine pre-production test data to verify
live PANs are not used in pre-production
environments, except where those environments
are in a CDE and protected in accordance with allapplicable PCI DSS requirements.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeUse of live PANs outside of protected CDEs
provides malicious individuals with the opportunity
to gain unauthorized access to cardholder data.
Good Practice
Entities can minimize their storage of live PANs
by only storing them in pre-production whenstrictly necessary for a specific and defined
testing purpose and securely deleting that data
after use.
If an entity requires PANs specifically designed
for test purposes, these can be obtained fromacquirers.
Definitions
Live PANs refer to valid PANs (not test PANs)
that have the potential to be used to conduct
payment transactions. Additionally, when
payment cards expire, the same PAN is often
reused with a different expiry date. All PANs must
be verified as being unable to conduct paymenttransactions before they are excluded from PCI
DSS scope. It is the responsibility of the entity toconfirm that PANs are not live.

March 2022
Page 147

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

6.5.6 Test data and test accounts are removed fromsystem components before the system goes into
production.

6.5.6.a Examine policies and procedures to verify
that processes are defined for removal of test data
and test accounts from system components before
the system goes into production.
6.5.6.b Observe testing processes for both off-theshelf software and in-house applications, andinterview personnel to verify test data and test
accounts are removed before a system goes into
production.

Customized Approach Objective
Test data and test accounts cannot exist in
production environments.

Guidance
PurposeThis data may give away information about thefunctioning of an application or system and is aneasy target for unauthorized individuals to exploit
to gain access to systems. Possession of suchinformation could facilitate compromise of thesystem and related account data.

6.5.6.c Examine data and accounts for recently
installed or updated off-the-shelf software and inhouse applications to verify there is no test data or
test accounts on systems in production.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 148

Implement Strong Access Control Measures
Requirement 7:

Restrict Access to System Components and Cardholder Data by Business Need to Know
Sections

7.1
7.2
7.3

Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined andunderstood.
Access to system components and data is appropriately defined and assigned.
Access to system components and data is managed via an access control system(s).
Overview

Unauthorized individuals may gain access to critical data or systems due to ineffective access control rules and definitions. To ensure critical
data can only be accessed by authorized personnel, systems and processes must be in place to limit access based on need to know andaccording to job responsibilities.
“Access” or “access rights” are created by rules that provide users access to systems, applications, and data, while “privileges” allow a user toperform a specific action or function in relation to that system, application, or data. For example, a user may have access rights to specific data,
but whether they can only read that data, or can also change or delete the data is determined by the user’s assigned privileges.
“Need to know” refers to providing access to only the least amount of data needed to perform a job.
“Least privileges” refers to providing only the minimum level of privileges needed to perform a job.
These requirements apply to user accounts and access for employees, contractors, consultants, and internal and external vendors and otherthird parties (for example, for providing support or maintenance services). Certain requirements also apply to application and system accounts
used by the entity (also called “service accounts”).
These requirements do not apply to consumers (cardholders).
Refer to Appendix G for definitions of PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 149

Requirements and Testing Procedures

Guidance

7.1 Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understood.

Defined Approach Requirements

Defined Approach Testing Procedures

7.1.1 All security policies and operational
procedures that are identified in Requirement 7 are:7.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures identified in Requirement 7
are managed in accordance with all elements
specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 7 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 7.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 7.
While it is important to define the specific policies
or procedures called out in Requirement 7, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives.

March 2022
Page 150

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

7.1.2 Roles and responsibilities for performing
activities in Requirement 7 are documented,
assigned, and understood.

7.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 7 are
documented and assigned.

Customized Approach Objective

7.1.2.b Interview personnel with responsibility for
performing activities in Requirement 7 to verify thatroles and responsibilities are assigned as and areunderstood.

Day-to-day responsibilities for performing all theactivities in Requirement 7 are allocated. Personnel
are accountable for successful, continuous
operation of these requirements.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, personnel may not be aware of their
day-to-day responsibilities, and critical activities
may not occur.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 151

Requirements and Testing Procedures

Guidance

7.2 Access to system components and data is appropriately defined and assigned.

Defined Approach Requirements

Defined Approach Testing Procedures

7.2.1 An access control model is defined andincludes granting access as follows:

7.2.1.a Examine documented policies andprocedures and interview personnel to verify theaccess control model is defined in accordance withall elements specified in this requirement.

•

Appropriate access depending on the entity’sbusiness and access needs.

•

Access to system components and data
resources that is based on users’ jobclassification and functions.

•

The least privileges required (for example, user,
administrator) to perform a job function.

7.2.1.b Examine access control model settings andverify that access needs are appropriately definedin accordance with all elements specified in thisrequirement.

Customized Approach Objective
Access requirements are established according tojob functions following least-privilege and need-toknow principles.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeDefining an access control model that is
appropriate for the entity’s technology and access
control philosophy supports a consistent anduniform way of allocating access and reduces thepossibility of errors such as the granting ofexcessive rights.
Good Practice
A factor to consider when defining access needs
is the separation of duties principle. This principle
is intended to prevent fraud and misuse or theft ofresources. For example, 1) dividing missioncritical functions and information system support
functions among different individuals and/or
functions, 2) establishing roles such that
information system support activities are
performed by different functions/individuals (forexample, system management, programming,
configuration management, quality assurance andtesting, and network security), and 3) ensuring
security personnel administering access control
functions do not also administer audit functions.
In environments where one individual performs
multiple functions, such as administration andsecurity operations, duties may be assigned sothat no single individual has end-to-end control ofa process without an independent checkpoint. For
example, responsibility for configuration andresponsibility for approving changes could be
assigned to separate individuals.
(continued on next page)

March 2022
Page 152

Requirements and Testing Procedures

Guidance
Definitions
Key elements of an access control model include:•

Resources to be protected (thesystems/devices/data to which access isneeded),•Job functions that need access to the resource(for example, system administrator, call-center
personnel, store clerk), andWhich activities each job function needs toperform (for example, read/write or query).
Once job functions, resources, and activities perjob functions are defined, individuals can be
granted access accordingly.
ExamplesAccess control models that entities can consider
include role-based access control (RBAC) andattribute-based access control (ABAC). The
access control model used by a given entity
depends on their business and access needs.

•

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 153

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

7.2.2 Access is assigned to users, including
privileged users, based on:

7.2.2.a Examine policies and procedures to verify
they cover assigning access to users inaccordance with all elements specified in thisrequirement.

•

Job classification and function.

•

Least privileges necessary to perform job
responsibilities.

Customized Approach Objective
Access to systems and data is limited to only theaccess needed to perform job functions, as definedin the related access roles.

7.2.2.b Examine user access settings, including forprivileged users, and interview responsible
management personnel to verify that privileges
assigned are in accordance with all elements
specified in this requirement.
7.2.2.c Interview personnel responsible forassigning access to verify that privileged user
access is assigned in accordance with all elements
specified in this requirement.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeAssigning least privileges helps prevent users
without sufficient knowledge about the applicationfrom incorrectly or accidentally changing
application configuration or altering its security
settings. Enforcing least privilege also helps tominimize the scope of damage if an unauthorized
person gains access to a user ID.
Good PracticeAccess rights are granted to a user byassignment to one or several functions. Assess is
assigned depending on the specific user functions
and with the minimum scope required for the job.
When assigning privileged access, it is important
to assign individuals only the privileges they needto perform their job (the “least privileges”). For
example, the database administrator or backup
administrator should not be assigned the same
privileges as the overall systems administrator.
Once needs are defined for user functions (perPCI DSS requirement 7.2.1), it is easy to grantindividuals access according to their jobclassification and function by using the alreadycreated roles.
Entities may wish to consider use of Privileged
Access Management (PAM), which is a method togrant access to privileged accounts only whenthose privileges are required, immediately
revoking that access once they are no longer
needed.

March 2022
Page 154

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

7.2.3 Required privileges are approved byauthorized personnel.

7.2.3.a Examine policies and procedures to verify
they define processes for approval of all privilegesby authorized personnel.

Customized Approach Objective
Access privileges cannot be granted to users
without appropriate, documented authorization.

7.2.3.b Examine user IDs and assigned privileges,
and compare with documented approvals to verify
that:•

Guidance
PurposeDocumented approval (for example, in writing orelectronically) assures that those with access andprivileges are known and authorized bymanagement, and that their access is necessary
for their job function.

Documented approval exists for the assigned
privileges.

•

The approval was by authorized personnel.

•

Specified privileges match the roles assigned tothe individual.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 155

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

7.2.4 All user accounts and related accessprivileges, including third-party/vendor accounts, arereviewed as follows:

7.2.4.a Examine policies and procedures to verify
they define processes to review all user accounts
and related access privileges, including thirdparty/vendor accounts, in accordance with allelements specified in this requirement.

•

At least once every six months.

•

To ensure user accounts and access remain
appropriate based on job function.

•

Any inappropriate access is addressed.

•

Management acknowledges that access remains
appropriate.

7.2.4.b Interview responsible personnel andexamine documented results of periodic reviews ofuser accounts to verify that all the results are inaccordance with all elements specified in thisrequirement.

Customized Approach Objective
Account privilege assignments are verified
periodically by management as correct, andnonconformities are remediated.

Applicability Notes
This requirement applies to all user accounts andrelated access privileges, including those used bypersonnel and third parties/vendors, and accounts
used to access third-party cloud services.
See Requirements 7.2.5 and 7.2.5.1 and 8.6.1
through 8.6.3 for controls for application and system
accounts.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeRegular review of access rights helps to detect
excessive access rights remaining after user job
responsibilities change, system functions change,or other modifications. If excessive user rights are
not revoked in due time, they may be used bymalicious users for unauthorized access.
This review provides another opportunity toensure that accounts for all terminated users havebeen removed (if any were missed at the time oftermination), as well as to ensure that any third
parties that no longer need access have had theiraccess terminated.
Good Practice
When a user transfers into a new role or a new
department, typically the privileges and accessassociated with their former role are no longer
required. Continued access to privileges orfunctions that are no longer required may
introduce the risk of misuse or errors. Therefore,
when responsibilities change, processes that
revalidate access help to ensure user access isappropriate for the user’s new responsibilities.
Entities can consider implementing a regular,
repeatable process for conducting reviews ofaccess rights, and assigning “data owners” thatare responsible for managing and monitoring
access to data related to their job function andthat also ensure user access remains current andappropriate. As an example, a direct manager
could review team access monthly, while thesenior manager reviews their groups’ accessquarterly, both making updates to access asneeded. The intent of these best practices is tosupport and facilitate conducting the reviews at
least once every 6 months.

March 2022
Page 156

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

7.2.5 All application and system accounts andrelated access privileges are assigned andmanaged as follows:

7.2.5.a Examine policies and procedures to verify
they define processes to manage and assign
application and system accounts and related
access privileges in accordance with all elements
specified in this requirement.

•

Based on the least privileges necessary for theoperability of the system or application.

•

Access is limited to the systems, applications, orprocesses that specifically require their use.

Customized Approach Objective
Access rights granted to application and system
accounts are limited to only the access needed forthe operability of that application or system.

7.2.5.b Examine privileges associated with system
and application accounts and interview responsible
personnel to verify that application and system
accounts and related access privileges are
assigned and managed in accordance with allelements specified in this requirement.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIt is important to establish the appropriate accesslevel for application or system accounts. If suchaccounts are compromised, malicious users will
receive the same access level as that granted tothe application or system. Therefore, it isimportant to ensure limited access is granted tosystem and application accounts on the same
basis as to user accounts.
Good Practice
Entities may want to consider establishing abaseline when setting up these application andsystem accounts including the following as
applicable to the organization:•

Making sure that the account is not a memberof a privileged group such as domain
administrators, local administrators, or root.

•

Restricting which computers the account canbe used on.

•

Restricting hours of use.

•

Removing any additional settings like VPN
access and remote access.

March 2022
Page 157

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

7.2.5.1 All access by application and system
accounts and related access privileges are reviewed
as follows:

7.2.5.1.a Examine policies and procedures to verify
they define processes to review all application andsystem accounts and related access privileges inaccordance with all elements specified in thisrequirement.

••

Periodically (at the frequency defined in theentity’s targeted risk analysis, which is performed
according to all elements specified in
Requirement 12.3.1).
The application/system access remains
appropriate for the function being performed.

•

Any inappropriate access is addressed.

•

Management acknowledges that access remains
appropriate.

Customized Approach Objective
Application and system account privilege
assignments are verified periodically bymanagement as correct, and nonconformities are
remediated.

Guidance
PurposeRegular review of access rights helps to detect
excessive access rights remaining after system
functions change, or other application or systemmodifications occur. If excessive rights are notremoved when no longer needed, they may be
used by malicious users for unauthorized access.

7.2.5.1.b Examine the entity’s targeted risk
analysis for the frequency of periodic reviews ofapplication and system accounts and related
access privileges to verify the risk analysis was
performed in accordance with all elements
specified in Requirement 12.3.1.
7.2.5.1.c Interview responsible personnel andexamine documented results of periodic reviews ofsystem and application accounts and related
privileges to verify that the reviews occur inaccordance with all elements specified in thisrequirement.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 158

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

7.2.6 All user access to query repositories of stored
cardholder data is restricted as follows:

7.2.6.a Examine policies and procedures andinterview personnel to verify processes are definedfor granting user access to query repositories ofstored cardholder data, in accordance with allelements specified in this requirement.

•

Via applications or other programmatic methods,
with access and allowed actions based on user
roles and least privileges.

•

Only the responsible administrator(s) can directly
access or query repositories of stored CHD.

Customized Approach Objective

7.2.6.b Examine configuration settings for querying
repositories of stored cardholder data to verify they
are in accordance with all elements specified inthis requirement.

Direct unfiltered (ad hoc) query access to
cardholder data repositories is prohibited, unlessperformed by an authorized administrator.

Applicability Notes
This requirement applies to controls for user accessto query repositories of stored cardholder data.
See Requirements 7.2.5 and 7.2.5.1 and 8.6.1
through 8.6.3 for controls for application and system
accounts.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeThe misuse of query access to repositories of
cardholder data has been a regular cause of data
breaches. Limiting such access to administrators
reduces the risk of such access being abused byunauthorized users.
Definitions“Programmatic methods” means granting accessthrough means such as database stored
procedures that allow users to perform controlled
actions to data in a table, rather than via direct,
unfiltered access to the data repository by end
users (except for the responsible administrator(s),who need direct access to the database for theiradministrative duties).
Good Practice
Typical user actions include moving, copying, anddeleting data. Also consider the scope of privilege
needed when granting access. For example,
access can be granted to specific objects such asdata elements, files, tables, indexes, views, andstored routines. Granting access to repositories of
cardholder data should follow the same process
as all other granted access, meaning that it isbased on roles, with only the privileges assigned
to each user that are needed to perform their job
functions.

March 2022
Page 159

Requirements and Testing Procedures

Guidance

7.3 Access to system components and data is managed via an access control system(s).

Defined Approach Requirements

Defined Approach Testing Procedures

7.3.1 An access control system(s) is in place that
restricts access based on a user’s need to know
and covers all system components.

7.3.1 Examine vendor documentation and systemsettings to verify that access is managed for eachsystem component via an access control system(s)that restricts access based on a user’s need toknow and covers all system components.

Customized Approach Objective

PurposeWithout a mechanism to restrict access based onuser’s need to know, a user may unknowingly be
granted access to cardholder data. Access control
systems automate the process of restricting
access and assigning privileges.

Access rights and privileges are managed via
mechanisms intended for that purpose.

Defined Approach Requirements

Defined Approach Testing Procedures

7.3.2 The access control system(s) is configured to
enforce permissions assigned to individuals,
applications, and systems based on job
classification and function.

7.3.2 Examine vendor documentation and systemsettings to verify that the access control system(s)is configured to enforce permissions assigned toindividuals, applications, and systems based on job
classification and function.

PurposeRestricting privileged access with an access
control system reduces the opportunity for errors
in the assignment of permissions to individuals,
applications, and systems.

Customized Approach Objective
Individual account access rights and privileges tosystems, applications, and data are only inheritedfrom group membership.

Defined Approach Requirements

Defined Approach Testing Procedures

7.3.3 The access control system(s) is set to “denyall” by default.

7.3.3 Examine vendor documentation and systemsettings to verify that the access control system(s)is set to “deny all” by default.

Customized Approach Objective
Access rights and privileges are prohibited unlessexpressly permitted.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeA default setting of “deny all” ensures no one is
granted access unless a rule is establishedspecifically granting such access.
Good Practice
It is important to check the default configuration ofaccess control systems because some are set bydefault to “allow all,” thereby permitting accessunless/until a rule is written to specifically deny it.

March 2022
Page 160

Requirement 8:

Identify Users and Authenticate Access to System Components
Sections

8.1
8.2
8.3
8.4
8.5
8.6

Processes and mechanisms for identifying users and authenticating access to system components are defined and understood.
User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycle.
Strong authentication for users and administrators is established and managed.
Multi-factor authentication (MFA) is implemented to secure access into the CDE
Multi-factor authentication (MFA) systems are configured to prevent misuse.
Use of application and system accounts and associated authentication factors is strictly managed.
Overview

Two fundamental principles of identifying and authenticating users are to 1) establish the identity of an individual or process on a computer
system, and 2) prove or verify the user associated with the identity is who the user claims to be.
Identification of an individual or process on a computer system is conducted by associating an identity with a person or process through an
identifier, such as a user, system, or application ID. These IDs (also referred to as “accounts”) fundamentally establish the identity of anindividual or process by assigning unique identification to each person or process to distinguish one user or process from another. When eachuser or process can be uniquely identified, it ensures there is accountability for actions performed by that identity. When such accountability is inplace, actions taken can be traced to known and authorized users and processes.
The element used to prove or verify the identity is known as the authentication factor. Authentication factors are 1) something you know, suchas a password or passphrase, 2) something you have, such as a token device or smart card, or 3) something you are, such as a biometricelement.
The ID and the authentication factor together are considered authentication credentials and are used to gain access to the rights and privileges
associated with a user, application, system, or service accounts.
(continued on next page)

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 161

These requirements for identity and authentication are based on industry-accepted security principles and best practices to support the payment
ecosystem. NIST Special Publication 800-63, Digital Identity Guidelines provides additional information on acceptable frameworks for digital
identity and authentication factors. It is important to note that the NIST Digital Identity Guidelines is intended for US Federal Agencies andshould be viewed in its entirety. Many of the concepts and approaches defined in these guidelines are expected to work with each other andnot as standalone parameters.
Note: Unless otherwise stated in the requirement, these requirements apply to all accounts on all system components, unless specificallycalled out in an individual requirement, including but not limited to:•

Point-of-sale accounts•

Accounts with administrative capabilities•

System and application accounts• All accounts used to view or access cardholder data or to access systems with cardholder data.
This includes accounts used by employees, contractors, consultants, internal and external vendors, and other third parties (for example, forproviding support or maintenance services).
Certain requirements are not intended to apply to user accounts that have access to only one card number at a time to facilitate a single
transaction (such as IDs used by cashiers on point-of-sale terminals). When items do not apply, they are noted directly within the specificrequirement.
These requirements do not apply to accounts used by consumers (cardholders).
Refer to Appendix G for definitions of PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 162

Requirements and Testing Procedures

Guidance

8.1 Processes and mechanisms for identifying users and authenticating access to system components are defined and understood.

Defined Approach Requirements

Defined Approach Testing Procedures

8.1.1 All security policies and operational
procedures that are identified in Requirement 8 are:8.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures that are identified in
Requirement 8 are managed in accordance with allelements specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 8 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 8.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 8.
While it is important to define the specific policies
or procedures called out in Requirement 8, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives.

March 2022
Page 163

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.1.2 Roles and responsibilities for performing
activities in Requirement 8 are documented,
assigned, and understood.

8.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 8 are
documented and assigned.

Customized Approach Objective

8.1.2.b Interview personnel with responsibility for
performing activities in Requirement 8 to verify thatroles and responsibilities are assigned as
documented and are understood.

Day-to-day responsibilities for performing all theactivities in Requirement 8 are allocated. Personnel
are accountable for successful, continuous
operation of these requirements.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, personnel may not be aware of their
day-to-day responsibilities and critical activities
may not occur.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 164

Requirements and Testing Procedures

Guidance

8.2 User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycle.

Defined Approach Requirements

Defined Approach Testing Procedures

8.2.1 All users are assigned a unique ID before
access to system components or cardholder data isallowed.

8.2.1.a Interview responsible personnel to verify
that all users are assigned a unique ID for accessto system components and cardholder data.

Customized Approach Objective
All actions by all users are attributable to anindividual.

8.2.1.b Examine audit logs and other evidence toverify that access to system components andcardholder data can be uniquely identified andassociated with individuals.

PurposeThe ability to trace actions performed on acomputer system to an individual establishes
accountability and traceability and is fundamental
to establishing effective access controls.
By ensuring each user is uniquely identified,instead of using one ID for several employees, anorganization can maintain individual responsibility
for actions and an effective record in the audit log
per employee. In addition, this will assist withissue resolution and containment when misuse or
malicious intent occurs.

Applicability Notes
This requirement is not intended to apply to user
accounts within point-of-sale terminals that haveaccess to only one card number at a time tofacilitate a single transaction (such as IDs used bycashiers on point-of-sale terminals).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 165

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.2.2 Group, shared, or generic accounts, or othershared authentication credentials are only used
when necessary on an exception basis, and aremanaged as follows:

8.2.2.a Examine user account lists on systemcomponents and applicable documentation to
verify that shared authentication credentials are
only used when necessary, on an exception basis,
and are managed in accordance with all elements
specified in this requirement.

•

Account use is prevented unless needed for an
exceptional circumstance.

•

Use is limited to the time needed for the
exceptional circumstance.

•

Business justification for use is documented.

•

Use is explicitly approved by management.

•

Individual user identity is confirmed before
access to an account is granted.

•

Every action taken is attributable to an individualuser.

Customized Approach Objective

8.2.2.b Examine authentication policies andprocedures to verify processes are defined forshared authentication credentials such that they
are only used when necessary, on an exception
basis, and are managed in accordance with allelements specified in this requirement.
8.2.2.c Interview system administrators to verify
that shared authentication credentials are onlyused when necessary, on an exception basis, andare managed in accordance with all elements
specified in this requirement.

All actions performed by users with generic, system,or shared IDs are attributable to an individual
person.

Applicability Notes
This requirement is not intended to apply to user
accounts within point-of-sale terminals that haveaccess to only one card number at a time tofacilitate a single transaction (such as IDs used bycashiers on point-of-sale terminals).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeGroup, shared, or generic (or default) accounts
are typically delivered with software or operating
systems—for example, root or with privileges
associated with a specific function, such as anadministrator.
If multiple users share the same authentication
credentials (for example, user account andpassword), it becomes impossible to trace systemaccess and activities to an individual. In turn, thisprevents an entity from assigning accountability
for, or having effective logging of, an individual’s
actions since a given action could have been
performed by anyone in the group with knowledgeof the user ID and associated authentication
factors.
The ability to associate individuals to the actions
performed with an account is essential to provide
individual accountability and traceability regarding
who performed an action, what action was
performed, and when that action occurred.
Good Practice
If shared accounts are used for any reason,strong management controls need to beestablished to maintain individual accountability
and traceability.
(continued on next page)

March 2022
Page 166

Requirements and Testing Procedures

Guidance
ExamplesTools and techniques can facilitate bothmanagement and security of these types ofaccounts and confirm individual user identity
before access to an account is granted. Entities
can consider password vaults or other systemmanaged controls such as the sudo command.
An example of an exceptional circumstance iswhere all other authentication methods havefailed, and a shared account is needed for
emergency use or “break the glass” administrator
access.

Defined Approach Requirements

Defined Approach Testing Procedures

8.2.3 Additional requirement for service
providers only: Service providers with remote
access to customer premises use uniqueauthentication factors for each customer premises.

8.2.3 Additional testing procedure for service
provider assessments only: Examine
authentication policies and procedures andinterview personnel to verify that service providers
with remote access to customer premises use
unique authentication factors for remote access toeach customer premises.

Customized Approach Objective
A service provider’s credential used for one
customer cannot be used for any other customer.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.
This requirement is not intended to apply to service
providers accessing their own shared services
environments, where multiple customer
environments are hosted.
If service provider employees use sharedauthentication factors to remotely access customer
premises, these factors must be unique per
customer and managed in accordance with
Requirement 8.2.2.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeService providers with remote access to customer
premises typically use this access to support POS
POI systems or provide other remote services.
If a service provider uses the same authentication
factors to access multiple customers, all theservice provider’s customers can easily becompromised if an attacker compromises that one
factor.
Criminals know this and deliberately target
service providers looking for a sharedauthentication factor that gives them remote
access to many merchants via that single factor.
ExamplesTechnologies such as multi-factor mechanismsthat provide a unique credential for eachconnection (such as a single-use password) could
also meet the intent of this requirement.

March 2022
Page 167Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.2.4 Addition, deletion, and modification of userIDs, authentication factors, and other identifier
objects are managed as follows:

8.2.4 Examine documented authorizations acrossvarious phases of the account lifecycle (additions,modifications, and deletions) and examine systemsettings to verify the activity has been managed inaccordance with all elements specified in thisrequirement.

•

Authorized with the appropriate approval.

•

Implemented with only the privileges specified
on the documented approval.

Customized Approach Objective
Lifecycle events for user IDs and authentication
factors cannot occur without appropriate
authorization.

Guidance
PurposeIt is imperative that the lifecycle of a user ID(additions, deletions, and modifications) is
controlled so that only authorized accounts canperform functions, actions are auditable, andprivileges are limited to only what is required.
Attackers often compromise an existing accountand then escalate the privileges of that account toperform unauthorized acts, or they may create
new IDs to continue their activity in the
background. It is essential to detect and respondwhen user accounts are created or changed
outside the normal change process or without
corresponding authorization.

Applicability Notes
This requirement applies to all user accounts,
including employees, contractors, consultants,
temporary workers, and third-party vendors.

Defined Approach Requirements

Defined Approach Testing Procedures

8.2.5 Access for terminated users is immediately
revoked.

8.2.5.a Examine information sources for terminatedusers and review current user access lists—forboth local and remote access—to verify thatterminated user IDs have been deactivated or
removed from the access lists.

Customized Approach Objective
The accounts of terminated users cannot be used.

PurposeIf an employee or third party/vendor has left thecompany and still has access to the network via
their user account, unnecessary or malicious
access to cardholder data could occur—either by
the former employee or by a malicious user who
exploits the old and/or unused account.

8.2.5.b Interview responsible personnel to verify
that all physical authentication factors—such as,
smart cards, tokens, etc.—have been returned ordeactivated for terminated users.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 168Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.2.6 Inactive user accounts are removed or
disabled within 90 days of inactivity.

8.2.6 Examine user accounts and last logon
information, and interview personnel to verify that
any inactive user accounts are removed or
disabled within 90 days of inactivity.

Customized Approach Objective
Inactive user accounts cannot be used.

Defined Approach Requirements

Defined Approach Testing Procedures

8.2.7 Accounts used by third parties to access,support, or maintain system components via remote
access are managed as follows:

8.2.7 Interview personnel, examine documentation
for managing accounts, and examine evidence toverify that accounts used by third parties forremote access are managed according to allelements specified in this requirement.

•

Enabled only during the time period needed anddisabled when not in use.

•

Use is monitored for unexpected activity.

Customized Approach Objective
Third party remote access cannot be used except
where specifically authorized and use is overseen
by management.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeAccounts that are not used regularly are often
targets of attack since it is less likely that any
changes, such as a changed password, will be
noticed. As such, these accounts may be moreeasily exploited and used to access cardholder
data.
Good Practice
Where it may be reasonably anticipated that an
account will not be used for an extended period oftime, such as an extended leave of absence, theaccount should be disabled as soon as the leave
begins, rather than waiting 90 days.
PurposeAllowing third parties to have 24/7 access into anentity’s systems and networks in case they needto provide support increases the chances ofunauthorized access. This access could result inan unauthorized user in the third party’s
environment or a malicious individual using thealways-available external entry point into anentity’s network. Where third parties do needaccess 24/7, it should be documented, justified,monitored, and tied to specific service reasons.
Good PracticeEnabling access only for the time periods needed
and disabling it as soon as it is no longer required
helps prevent misuse of these connections.
Additionally, consider assigning third parties astart and stop date for their access in accordancewith their service contract.
Monitoring third-party access helps ensure thatthird parties are accessing only the systems
necessary and only during approved time frames.
Any unusual activity using third-party accounts
should be followed up and resolved.

March 2022
Page 169

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.2.8 If a user session has been idle for more than
15 minutes, the user is required to re-authenticate tore-activate the terminal or session.

8.2.8 Examine system configuration settings toverify that system/session idle timeout features foruser sessions have been set to 15 minutes or less.

Customized Approach Objective
A user session cannot be used except by theauthorized user.

Applicability Notes
This requirement is not intended to apply to user
accounts on point-of-sale terminals that haveaccess to only one card number at a time tofacilitate a single transaction (such as IDs used bycashiers on point-of-sale terminals).
This requirement is not meant to prevent legitimate
activities from being performed while theconsole/PC is unattended.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeWhen users walk away from an open machinewith access to system components or cardholder
data, there is a risk that the machine may be usedby others in the user’s absence, resulting inunauthorized account access and/or misuse.
Good Practice
The re-authentication can be applied either at thesystem level to protect all sessions running onthat machine or at the application level.
Entities may also want to consider staging
controls in succession to further restrict theaccess of an unattended session as time passes.
For example, the screensaver may activate after
15 minutes and log off the user after an hour.
However, timeout controls must balance the riskof access and exposure with the impact to theuser and purpose of the access.
If a user needs to run a program from anunattended computer, the user can log in to thecomputer to initiate the program, and then “lock”
the computer so that no one else can use theuser’s login while the computer is unattended.
ExamplesOne way to meet this requirement is to configure
an automated screensaver to launch wheneverthe console is idle for 15 minutes and requiring
the logged-in user to enter their password to
unlock the screen.

March 2022
Page 170Requirements and Testing Procedures

Guidance

8.3 Strong authentication for users and administrators is established and managed.

Defined Approach Requirements

Defined Approach Testing Procedures

8.3.1 All user access to system components forusers and administrators is authenticated via at
least one of the following authentication factors:

8.3.1.a Examine documentation describing theauthentication factor(s) used to verify that user
access to system components is authenticated via
at least one authentication factor specified in thisrequirement.

•

Something you know, such as a password or
passphrase.

•

Something you have, such as a token device orsmart card.

•

Something you are, such as a biometric element.

Customized Approach Objective

8.3.1.b For each type of authentication factor usedwith each type of system component, observe an
authentication to verify that authentication isfunctioning consistently with documented
authentication factor(s).

An account cannot be accessed except with a
combination of user identity and an authentication
factor.

PurposeWhen used in addition to unique IDs, anauthentication factor helps protect user IDs frombeing compromised, since the attacker needs tohave the unique ID and compromise theassociated authentication factor(s).
Good Practice
A common approach for a malicious individual tocompromise a system is to exploit weak or
nonexistent authentication factors (for example,
passwords/passphrases). Requiring strong
authentication factors helps protect against this
attack.
Further Information
See fidoalliance.org for more information about
using tokens, smart cards, or biometrics asauthentication factors.

Applicability Notes
This requirement is not intended to apply to user
accounts on point-of-sale terminals that haveaccess to only one card number at a time tofacilitate a single transaction (such as IDs used bycashiers on point-of-sale terminals).
This requirement does not supersede multi-factor
authentication (MFA) requirements but applies tothose in-scope systems not otherwise subject to
MFA requirements.
A digital certificate is a valid option for “something
you have” if it is unique for a particular user.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 171

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.3.2 Strong cryptography is used to render all
authentication factors unreadable duringtransmission and storage on all systemcomponents.

8.3.2.a Examine vendor documentation andsystem configuration settings to verify thatauthentication factors are rendered unreadable
with strong cryptography during transmission andstorage.
8.3.2.b Examine repositories of authentication
factors to verify that they are unreadable duringstorage.

Customized Approach Objective

Guidance
Purpose
Network devices and applications have been
known to transmit unencrypted, readable
authentication factors (such as passwords andpassphrases) across the network and/or store
these values without encryption. As a result, a
malicious individual can easily intercept thisinformation during transmission using a “sniffer,”or directly access unencrypted authentication
factors in files where they are stored, and thenuse this data to gain unauthorized access.

8.3.2.c Examine data transmissions to verify thatauthentication factors are unreadable duringtransmission.

Cleartext authentication factors cannot be obtained,
derived, or reused from the interception ofcommunications or from stored data.

Defined Approach Requirements

Defined Approach Testing Procedures

8.3.3 User identity is verified before modifying any
authentication factor.

8.3.3 Examine procedures for modifying
authentication factors and observe security
personnel to verify that when a user requests a
modification of an authentication factor, the user’s
identity is verified before the authentication factor
is modified.

Customized Approach Objective
Unauthorized individuals cannot gain system accessby impersonating the identity of an authorized user.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Purpose
Malicious individuals use "social engineering”
techniques to impersonate a user of a system —for example, calling a help desk and acting as alegitimate user—to have an authentication factor
changed so they can use a valid user ID.
Requiring positive identification of a user reduces
the probability of this type of attack succeeding.
Good Practice
Modifications to authentication factors for whichuser identity should be verified include but are notlimited to performing password resets,
provisioning new hardware or software tokens,and generating new keys.
ExamplesMethods to verify a user’s identity include a secretquestion/answer, knowledge-based information,and calling the user back at a known andpreviously established phone number.

March 2022
Page 172Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.3.4 Invalid authentication attempts are limited by:

8.3.4.a Examine system configuration settings toverify that authentication parameters are set torequire that user accounts be locked out after not
more than 10 invalid logon attempts.

•

Locking out the user ID after not more than 10
attempts.

•

Setting the lockout duration to a minimum of 30
minutes or until the user’s identity is confirmed.

Customized Approach Objective
An authentication factor cannot be guessed in abrute force, online attack.

8.3.4.b Examine system configuration settings toverify that password parameters are set to requirethat once a user account is locked out, it remains
locked for a minimum of 30 minutes or until theuser’s identity is confirmed.

Applicability Notes
This requirement is not intended to apply to user
accounts on point-of-sale terminals that haveaccess to only one card number at a time tofacilitate a single transaction (such as IDs used bycashiers on point-of-sale terminals).

Defined Approach Requirements

Defined Approach Testing Procedures

8.3.5 If passwords/passphrases are used asauthentication factors to meet Requirement 8.3.1,
they are set and reset for each user as follows:

8.3.5 Examine procedures for setting and resetting
passwords/passphrases (if used as authentication
factors to meet Requirement 8.3.1) and observe
security personnel to verify thatpasswords/passphrases are set and reset inaccordance with all elements specified in thisrequirement.

•

Set to a unique value for first-time use and upon
reset.

•

Forced to be changed immediately after the firstuse.

Guidance
PurposeWithout account-lockout mechanisms in place, anattacker can continually try to guess a password
through manual or automated tools (for example,
password cracking) until the attacker succeeds
and gains access to a user’s account.
If an account is locked out due to someone
continually trying to guess a password, controls todelay reactivation of the locked account stop the
malicious individual from guessing the password,
as they will have to stop for a minimum of 30
minutes until the account is reactivated.
Good Practice
Before reactivating a locked account, the user’s
identity should be confirmed. For example, theadministrator or help desk personnel can validatethat the actual account owner is requesting
reactivation, or there may be password reset selfservice mechanisms that the account owner uses
to verify their identity.
PurposeIf the same password/passphrase is used forevery new user, an internal user, former
employee, or malicious individual may know oreasily discover the value and use it to gain accessto accounts before the authorized user attempts
to use the password.

Customized Approach Objective
An initial or reset password/passphrase assigned toa user cannot be used by an unauthorized user.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 173Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.3.6 If passwords/passphrases are used asauthentication factors to meet Requirement 8.3.1,
they meet the following minimum level ofcomplexity:

8.3.6 Examine system configuration settings toverify that user password/passphrase complexity
parameters are set in accordance with all elements
specified in this requirement.

•

A minimum length of 12 characters (or IF thesystem does not support 12 characters, aminimum length of eight characters).

•

Contain both numeric and alphabetic characters.

Customized Approach Objective
A guessed password/passphrase cannot be verified
by either an online or offline brute force attack.

Applicability Notes
This requirement is not intended to apply to:•User accounts on point-of-sale terminals thathave access to only one card number at a time
to facilitate a single transaction (such as IDs
used by cashiers on point-of-sale terminals).

Application or system accounts, which aregoverned by requirements in section 8.6.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.
Until 31 March 2025, passwords must be aminimum length of seven characters in accordancewith PCI DSS v3.2.1 Requirement 8.2.3.

•

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeStrong passwords/passphrases may be the firstline of defense into a network since a malicious
individual will often first try to find accounts with
weak, static, or non-existent passwords. If
passwords are short or easily guessable, it isrelatively easy for a malicious individual to findthese weak accounts and compromise a network
under the guise of a valid user ID.
Good Practice
Password/passphrase strength is dependent on
password/passphrase complexity, length, andrandomness. Passwords/passphrases should be
sufficiently complex, so they are impractical for an
attacker to guess or otherwise discover its value.
Entities can consider adding increased complexity
by requiring the use of special characters andupper- and lower-case characters, in addition to
the minimum standards outlined by thisrequirement. Additional complexity increases thetime required for offline brute force attacks ofhashed passwords/passphrases.
Another option for increasing the resistance of
passwords to guessing attacks is by comparing
proposed password/passphrases to a bad
password list and having users provide new
passwords for any passwords found on the list.

March 2022
Page 174

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.3.7 Individuals are not allowed to submit a new
password/passphrase that is the same as any of thelast four passwords/passphrases used.

8.3.7 Examine system configuration settings toverify that password parameters are set to requirethat new passwords/passphrases cannot be thesame as the four previously usedpasswords/passphrases.

Customized Approach Objective
A previously used password cannot be used to gain
access to an account for at least 12 months.

Applicability Notes
This requirement is not intended to apply to user
accounts on point-of-sale terminals that haveaccess to only one card number at a time tofacilitate a single transaction (such as IDs used bycashiers on point-of-sale terminals).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf password history is not maintained, theeffectiveness of changing passwords is reduced,
as previous passwords can be reused over andover. Requiring that passwords cannot be reused
for a period reduces the likelihood that passwords
that have been guessed or brute-forced will be reused in the future.
Passwords or passphrases may have previously
been changed due to suspicion of compromise or
because the password or passphrase exceeded
its effective use period, both of which are reasons
why previously used passwords should not bereused.

March 2022
Page 175

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.3.8 Authentication policies and procedures are
documented and communicated to all users
including:

8.3.8.a Examine procedures and interview
personnel to verify that authentication policies andprocedures are distributed to all users.

•

Guidance on selecting strong authentication
factors.

•

Guidance for how users should protect theirauthentication factors.

•

Instructions not to reuse previously usedpasswords/passphrases.

•

Instructions to change passwords/passphrases if
there is any suspicion or knowledge that the
password/passphrases have been compromised
and how to report the incident.

8.3.8.b Review authentication policies andprocedures that are distributed to users and verify
they include the elements specified in thisrequirement.
8.3.8.c Interview users to verify that they arefamiliar with authentication policies andprocedures.

Customized Approach Objective
Users are knowledgeable about the correct use ofauthentication factors and can access assistanceand guidance when required.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeCommunicating authentication policies andprocedures to all users helps them to understandand abide by the policies.
Good PracticeGuidance on selecting strong passwords may
include suggestions to help personnel selecthard-to-guess passwords that do not contain
dictionary words or information about the user,
such as the user ID, names of family members,
date of birth, etc.
Guidance for protecting authentication factors
may include not writing down passwords or notsaving them in insecure files, and being alert tomalicious individuals who may try to exploit theirpasswords (for example, by calling an employee
and asking for their password so the caller can“troubleshoot a problem”).
Alternatively, entities can implement processes toconfirm passwords meet password policy, forexample, by comparing password choices to a listof unacceptable passwords and having users
choose a new password for any that match with
one on the list. Instructing users to change
passwords if there is a chance the password is nolonger secure can prevent malicious users fromusing a legitimate password to gain unauthorizedaccess.

March 2022
Page 176

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.3.9 If passwords/passphrases are used as the
only authentication factor for user access (i.e., inany single-factor authentication implementation)then either:

8.3.9 If passwords/passphrases are used as the
only authentication factor for user access, inspect
system configuration settings to verify thatpasswords/passphrases are managed inaccordance with ONE of the elements specified inthis requirement.

•

Passwords/passphrases are changed at least
once every 90 days,
OR•

The security posture of accounts is dynamicallyanalyzed, and real-time access to resources is
automatically determined accordingly.

Customized Approach Objective
An undetected compromised password/passphrase
cannot be used indefinitely.

Applicability Notes
This requirement applies to in-scope systemcomponents that are not in the CDE because thesecomponents are not subject to MFA requirements.
This requirement is not intended to apply to user
accounts on point-of-sale terminals that haveaccess to only one card number at a time tofacilitate a single transaction (such as IDs used bycashiers on point-of-sale terminals).
This requirement does not apply to service
providers’ customer accounts but does apply to
accounts for service provider personnel.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeAccess to in-scope system components that are
not in the CDE may be provided using a single
authentication factor, such as a
password/passphrase, token device or smart
card, or biometric attribute. Where
passwords/passphrases are employed as the only
authentication factor for such access, additional
controls are required to protect the integrity of thepassword/passphrase.
Good Practice
Passwords/passphrases that are valid for a longtime without a change provide malicious
individuals with more time to break the
password/phrase. Periodically changing
passwords offers less time for a malicious
individual to crack a password/passphrase andless time to use a compromised password.
Using a password/passphrase as the only
authentication factor provides a single point of
failure if compromised. Therefore, in these
implementations, controls are needed to minimize
how long malicious activity could occur via acompromised password/passphrase.
Dynamically analyzing an account’s security
posture is another option that allows for more
rapid detection and response to address
potentially compromised credentials. Suchanalysis takes a number of data points, which
may include device integrity, location, accesstimes, and the resources accessed to determine
in real time whether an account can be granted
access to a requested resource. In this way,access can be denied and accounts blocked if it issuspected that authentication credentials havebeen compromised.
(continued on next page)

March 2022
Page 177

Requirements and Testing Procedures

Guidance
Further Information
For information about using dynamic analysis to
manage user access to resources, see NIST SP
800-207 Zero Trust Architecture.

Defined Approach Requirements

Defined Approach Testing Procedures

8.3.10 Additional requirement for service
providers only: If passwords/passphrases areused as the only authentication factor for customer
user access to cardholder data (i.e., in any singlefactor authentication implementation), thenguidance is provided to customer users including:

8.3.10 Additional testing procedure for service
provider assessments only: If
passwords/passphrases are used as the only
authentication factor for customer user access to
cardholder data, examine guidance provided tocustomer users to verify that the guidance includes
all elements specified in this requirement.

•

Guidance for customers to change their user
passwords/passphrases periodically.

•

Guidance as to when, and under whatcircumstances, passwords/passphrases are to
be changed.

Customized Approach Objective

PurposeUsing a password/passphrase as the only
authentication factor provides a single point of
failure if compromised. Therefore, in these
implementations, controls are needed to minimize
how long malicious activity could occur via acompromised password/passphrase.
Good Practice
Passwords/passphrases that are valid for a longtime without a change provide malicious
individuals with more time to break the
password/phrase. Periodically changing
passwords offers less time for a malicious
individual to crack a password/passphrase andless time to use a compromised password.

Passwords/passphrases for service providers’customers cannot be used indefinitely.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.
This requirement does not apply to accounts ofconsumer users accessing their own payment card
information.
This requirement for service providers will besuperseded by Requirement 8.3.10.1 once 8.3.10.1
becomes effective.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 178

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.3.10.1 Additional requirement for service
providers only: If passwords/passphrases areused as the only authentication factor for customer
user access (i.e., in any single-factor authentication
implementation) then either:

8.3.10.1 Additional testing procedure forservice provider assessments only: If
passwords/passphrases are used as the only
authentication factor for customer user access,inspect system configuration settings to verify thatpasswords/passphrases are managed inaccordance with ONE of the elements specified inthis requirement.

•

Passwords/passphrases are changed at least
once every 90 days,
OR•

The security posture of accounts is dynamicallyanalyzed, and real-time access to resources is
automatically determined accordingly.

Customized Approach Objective
Passwords/passphrases for service providers’customers cannot be used indefinitely.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.
This requirement does not apply to accounts ofconsumer users accessing their own payment card
information.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.
Until this requirement is effective on 31 March 2025,
service providers may meet either Requirement
8.3.10 or 8.3.10.1.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeUsing a password/passphrase as the only
authentication factor provides a single point of
failure if compromised. Therefore, in these
implementations, controls are needed to minimize
how long malicious activity could occur via acompromised password/passphrase.
Good Practice
Passwords/passphrases that are valid for a longtime without a change provide malicious
individuals with more time to break the
password/phrase. Periodically changing
passwords offers less time for a malicious
individual to crack a password/passphrase andless time to use a compromised password.
Dynamically analyzing an account’s security
posture is another option that allows for more
rapid detection and response to address
potentially compromised credentials. Suchanalysis takes a number of data points which may
include device integrity, location, access times,
and the resources accessed to determine in realtime whether an account can be granted accessto a requested resource. In this way, access canbe denied and accounts blocked if it is suspectedthat account credentials have been compromised.
Further Information
For information about using dynamic analysis to
manage user access to resources, refer to NIST
SP 800-207 Zero Trust Architecture.

March 2022
Page 179

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.3.11 Where authentication factors such as
physical or logical security tokens, smart cards, or
certificates are used:

8.3.11.a Examine authentication policies andprocedures to verify that procedures for using
authentication factors such as physical security
tokens, smart cards, and certificates are definedand include all elements specified in thisrequirement.

•

Factors are assigned to an individual user andnot shared among multiple users.

•

Physical and/or logical controls ensure only theintended user can use that factor to gain access.

Customized Approach Objective
An authentication factor cannot be used by anyone
other than the user to which it is assigned.

8.3.11.b Interview security personnel to verify
authentication factors are assigned to an individualuser and not shared among multiple users.
8.3.11.c Examine system configuration settings
and/or observe physical controls, as applicable, toverify that controls are implemented to ensure only
the intended user can use that factor to gain
access.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf multiple users can use authentication factors
such as tokens, smart cards, and certificates, it
may be impossible to identify the individual using
the authentication mechanism.
Good PracticeHaving physical and/or logical controls (forexample, a PIN, biometric data, or a password) touniquely authenticate the user of the account will
prevent unauthorized users from gaining accessto the user account through use of a sharedauthentication factor.

March 2022
Page 180

Requirements and Testing Procedures

Guidance

8.4 Multi-factor authentication (MFA) is implemented to secure access into the CDE.

Defined Approach Requirements

Defined Approach Testing Procedures

8.4.1 MFA is implemented for all non-console
access into the CDE for personnel withadministrative access.

8.4.1.a Examine network and/or system
configurations to verify MFA is required for all nonconsole into the CDE for personnel withadministrative access.

Customized Approach Objective

8.4.1.b Observe administrator personnel logging
into the CDE and verify that MFA is required.

Administrative access to the CDE cannot be
obtained by the use of a single authentication factor.

Applicability Notes

PurposeRequiring more than one type of authentication
factor reduces the probability that an attacker cangain access to a system by masquerading as alegitimate user, because the attacker would needto compromise multiple authentication factors.
This is especially true in environments wheretraditionally the single authentication factor
employed was something a user knows such as a
password or passphrase.
Definitions
Using one factor twice (for example, using two
separate passwords) is not considered multifactor authentication.

The requirement for MFA for non-console
administrative access applies to all personnel withelevated or increased privileges accessing the CDE
via a non-console connection—that is, via logicalaccess occurring over a network interface rather
than via a direct, physical connection.
MFA is considered a best practice for non-console
administrative access to in-scope systemcomponents that are not part of the CDE.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 181

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.4.2 MFA is implemented for all access into theCDE.

8.4.2.a Examine network and/or system
configurations to verify MFA is implemented for allaccess into the CDE.

Customized Approach Objective

8.4.2.b Observe personnel logging in to the CDE
and examine evidence to verify that MFA isrequired.

Access into the CDE cannot be obtained by the useof a single authentication factor.

Applicability Notes

Guidance
PurposeRequiring more than one type of authentication
factor reduces the probability that an attacker cangain access to a system by masquerading as alegitimate user, because the attacker would needto compromise multiple authentication factors.
This is especially true in environments wheretraditionally the single authentication factor
employed was something a user knows such as a
password or passphrase.
Definitions
Using one factor twice (for example, using two
separate passwords) is not considered multifactor authentication.

This requirement does not apply to:•

Application or system accounts performing
automated functions.

User accounts on point-of-sale terminals thathave access to only one card number at a time
to facilitate a single transaction (such as IDs
used by cashiers on point-of-sale terminals).
MFA is required for both types of access specified in
Requirements 8.4.2 and 8.4.3. Therefore, applying
MFA to one type of access does not replace theneed to apply another instance of MFA to the othertype of access. If an individual first connects to theentity’s network via remote access, and then later
initiates a connection into the CDE from within the
network, per this requirement the individual would
authenticate using MFA twice, once whenconnecting via remote access to the entity’s networkand once when connecting via non-console
administrative access from the entity’s network into
the CDE.
(continued on next page)•

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 182

Requirements and Testing Procedures

Guidance

The MFA requirements apply for all types of systemcomponents, including cloud, hosted systems, andon-premises applications, network security devices,
workstations, servers, and endpoints, and includes
access directly to an entity’s networks or systems aswell as web-based access to an application orfunction.
MFA for remote access into the CDE can be
implemented at the network or system/applicationlevel; it does not have to be applied at both levels.
For example, if MFA is used when a user connects
to the CDE network, it does not have to be used
when the user logs into each system or application
within the CDE.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 183

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.4.3 MFA is implemented for all remote network
access originating from outside the entity’s networkthat could access or impact the CDE as follows:

8.4.3.a Examine network and/or system
configurations for remote access servers andsystems to verify MFA is required in accordancewith all elements specified in this requirement.

••

All remote access by all personnel, both users
and administrators, originating from outside theentity’s network.
All remote access by third parties and vendors.

8.4.3.b Observe personnel (for example, users andadministrators) connecting remotely to the networkand verify that multi-factor authentication isrequired.

Customized Approach Objective
Remote access to the entity’s network cannot be
obtained by using a single authentication factor.

Applicability Notes

Guidance
PurposeRequiring more than one type of authentication
factor reduces the probability that an attacker cangain access to a system by masquerading as alegitimate user, because the attacker would needto compromise multiple authentication factors.
This is especially true in environments wheretraditionally the single authentication factor
employed was something a user knows, such asa password or passphrase.
Definitions
Multi-factor authentication (MFA) requires anindividual to present a minimum of two of thethree authentication factors specified in
Requirement 8.3.1 before access is granted.
Using one factor twice (for example, using two
separate passwords) is not considered multifactor authentication.

The requirement for MFA for remote accessoriginating from outside the entity’s network applies
to all user accounts that can access the network
remotely, where that remote access leads to or
could lead to access into the CDE.
If remote access is to a part of the entity’s networkthat is properly segmented from the CDE, such that
remote users cannot access or impact the CDE,
MFA for remote access to that part of the network is
not required. However, MFA is required for any
remote access to networks with access to the CDE
and is recommended for all remote access to theentity’s networks.
The MFA requirements apply for all types of systemcomponents, including cloud, hosted systems, andon-premises applications, network security devices,
workstations, servers, and endpoints, and includes
access directly to an entity’s networks or systems aswell as web-based access to an application orfunction.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 184

Requirements and Testing Procedures

Guidance

8.5 Multi-factor authentication (MFA) systems are configured to prevent misuse.

Defined Approach Requirements

Defined Approach Testing Procedures

8.5.1 MFA systems are implemented as follows:•

The MFA system is not susceptible to replay
attacks.

8.5.1.a Examine vendor system documentation to
verify that the MFA system is not susceptible toreplay attacks.

•

MFA systems cannot be bypassed by any users,
including administrative users unless specifically
documented, and authorized by management on
an exception basis, for a limited time period.

•

At least two different types of authentication
factors are used.

8.5.1.b Examine system configurations for the
MFA implementation to verify it is configured inaccordance with all elements specified in thisrequirement.

•

Success of all authentication factors is required
before access is granted.

8.5.1.c Interview responsible personnel andobserve processes to verify that any requests to
bypass MFA are specifically documented andauthorized by management on an exception basis,
for a limited time period.
8.5.1.d Observe personnel logging into systemcomponents in the CDE to verify that access isgranted only after all authentication factors are
successful.

Customized Approach Objective
MFA systems are resistant to attack and strictly
control any administrative overrides.

Purpose
Poorly configured MFA systems can be bypassed
by attackers. This requirement therefore
addresses configuration of MFA system(s) thatprovide MFA for users accessing systemcomponents in the CDE.
Definitions
Using one type of factor twice (for example, using
two separate passwords) is not considered multifactor authentication.
Further Information
For more information about MFA systems andfeatures, refer to the following:
PCI SSC’s Information Supplement: Multi-Factor
Authentication
PCI SSC’s Frequently Asked Questions (FAQs)
on this topic.

8.5.1.e Observe personnel connecting remotelyfrom outside the entity’s network to verify thataccess is granted only after all authentication
factors are successful.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 185

Requirements and Testing Procedures

Guidance

8.6 Use of application and system accounts and associated authentication factors is strictly managed.

Defined Approach Requirements

Defined Approach Testing Procedures

8.6.1 If accounts used by systems or applications
can be used for interactive login, they are managed
as follows:

8.6.1 Examine application and system accounts
that can be used interactively and interview
administrative personnel to verify that applicationand system accounts are managed in accordancewith all elements specified in this requirement.

•Interactive use is prevented unless needed foran exceptional circumstance.

•

Interactive use is limited to the time needed forthe exceptional circumstance.

•

Business justification for interactive use is
documented.

•

Interactive use is explicitly approved bymanagement.

•

Individual user identity is confirmed before
access to account is granted.

•

Every action taken is attributable to an individualuser.

Customized Approach Objective
When used interactively, all actions with accounts
designated as system or application accounts areauthorized and attributable to an individual person.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeLike individual user accounts, system andapplication accounts require accountability andstrict management to ensure they are used only
for the intended purpose and are not misused.
Attackers often compromise system or applicationaccounts to gain access to cardholder data.
Good Practice
Where possible, configure system and applicationaccounts to disallow interactive login to prevent
unauthorized individuals from logging in and using
the account with its associated system privileges,
and to limit the machines and devices on which
the account can be used.
Definitions
System or application accounts are thoseaccounts that execute processes or perform tasks
on a computer system or application and are nottypically accounts that an individual logs into.
These accounts usually have elevated privilegesthat are required to perform specialized tasks orfunctions.
Interactive login is the ability for a person to log
into a system or application account in the samemanner as a normal user account. Using system
and application accounts this way means there isno accountability and traceability of actions takenby the user.

March 2022
Page 186

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.6.2 Passwords/passphrases for any applicationand system accounts that can be used forinteractive login are not hard coded in scripts,
configuration/property files, or bespoke and custom
source code.

8.6.2.a Interview personnel and examine systemdevelopment procedures to verify that processes
are defined for application and system accounts
that can be used for interactive login, specifyingthat passwords/passphrases are not hard coded inscripts, configuration/property files, or bespoke andcustom source code.

Customized Approach Objective
Passwords/passphrases used by application andsystem accounts cannot be used by unauthorized
personnel.

8.6.2.b Examine scripts, configuration/property
files, and bespoke and custom source code forapplication and system accounts that can be used
for interactive login, to verify
passwords/passphrases for those accounts are notpresent.

Guidance
PurposeNot properly protecting passwords/passphrases
used by application and system accounts,
especially if those accounts can be used forinteractive login, increases the risk and successof unauthorized use of those privileged accounts.
Good Practice
Changing these values due to suspected orconfirmed disclosure can be particularly difficult toimplement.
Tools can facilitate both management andsecurity of authentication factors for applicationand system accounts. For example, consider
password vaults or other system-managed
controls.

Applicability Notes
Stored passwords/passphrases are required to be
encrypted in accordance with PCI DSS
Requirement 8.3.2.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 187

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

8.6.3 Passwords/passphrases for any applicationand system accounts are protected against misuse
as follows:

8.6.3.a Examine policies and procedures to verify
that procedures are defined to protect
passwords/passphrases for application or system
accounts against misuse in accordance with allelements specified in this requirement.

••

Passwords/passphrases are changed
periodically (at the frequency defined in theentity’s targeted risk analysis, which is performed
according to all elements specified in
Requirement 12.3.1) and upon suspicion orconfirmation of compromise.
Passwords/passphrases are constructed with
sufficient complexity appropriate for how
frequently the entity changes the
passwords/passphrases.

Customized Approach Objective
Passwords/passphrases used by application andsystem accounts cannot be used indefinitely andare structured to resist brute-force and guessing
attacks.

8.6.3.b Examine the entity’s targeted risk analysis
for the change frequency and complexity forpasswords/passphrases used for interactive login
to application and system accounts to verify therisk analysis was performed in accordance with allelements specified in Requirement 12.3.1 andaddresses:•

The frequency defined for periodic changes toapplication and system
passwords/passphrases.

•

The complexity defined forpasswords/passphrases and appropriateness ofthe complexity relative to the frequency ofchanges.

8.6.3.c Interview responsible personnel andexamine system configuration settings to verify thatpasswords/passphrases for any application andsystem accounts that can be used for interactive
login are protected against misuse in accordancewith all elements specified in this requirement.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Systems and application accounts pose more
inherent security risk than user accounts because
they often run in an elevated security context, withaccess to systems that may not be typicallygranted to user accounts, such as programmaticaccess to databases, etc. As a result, special
consideration must be made to protect
passwords/passphrases used for application andsystem accounts.
Good Practice
Entities should consider the following risk factors
when determining how to protect application andsystem passwords/passphrases against misuse:
How securely the passwords/passphrases
are stored (for example, whether they are
stored in a password vault).
•
Staff turnover.
•The number of people with access to theauthentication factor.
•
Whether the account can be used forinteractive login.
•
Whether the security posture of accounts isdynamically analyzed, and real-time accessto resources is automatically determinedaccordingly (see Requirement 8.3.9).
All these elements affect the level of risk forapplication and system accounts and might
impact the security of systems accessed by thesystem and application accounts.
(continued on next page)•

March 2022
Page 188

Requirements and Testing Procedures

Guidance
Entities should correlate their selected change
frequency for application and system
passwords/passwords with their selectedcomplexity for those passwords/passphrases –i.e., the complexity should be more rigorous when
passwords/passphrases are changed infrequently
and can be less rigorous when changed more
frequently. For example, a longer change
frequency is more justifiable when
passwords/passphrases complexity is set to 36
alphanumeric characters with upper- and lowercase letters, numbers, and special characters.
Best practices are to consider password changes
at least once a year, a password/passphrase
length of at least 15 characters, and complexity
for the passwords/passphrase of alphanumericcharacters, with upper- and lower-case letters,
and special characters.
Further Information
For information about variability and equivalencyof password strength for passwords/passphrasesof different formats, see the industry standards(for example, the current version of NIST SP 80063 Digital Identity Guidelines).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 189

Requirement 9:

Restrict Physical Access to Cardholder Data
Sections

9.1
9.2
9.3
9.4
9.5

Processes and mechanisms for restricting physical access to cardholder data are defined and understood.
Physical access controls manage entry into facilities and systems containing cardholder data.
Physical access for personnel and visitors is authorized and managed.
Media with cardholder data is securely stored, accessed, distributed, and destroyed.
Point of interaction (POI) devices are protected from tampering and unauthorized substitution.
Overview

Any physical access to cardholder data or systems that store, process, or transmit cardholder data provides the opportunity for individuals toaccess and/or remove systems or hardcopies containing cardholder data; therefore, physical access should be appropriately restricted.
There are three different areas mentioned in Requirement 9:
1. Requirements that specifically refer to sensitive areas are intended to apply to those areas only.
2. Requirements that specifically refer to the cardholder data environment (CDE) are intended to apply to the entire CDE, including any
sensitive areas residing within the CDE.
3. Requirements that specifically refer to the facility are referencing the types of controls that may be managed more broadly at thephysical boundary of a business premise (such as a building) within which CDEs and sensitive areas reside. These controls often exist
outside a CDE or sensitive area, for example a guard desk that identifies, badges, and logs visitors. The term “facility” is used torecognize that these controls may exist at different places within a facility, for instance, at building entry or at an internal entrance to adata center or office space.
Refer to Appendix G for definitions of “media,” “personnel,” “sensitive areas” and other PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 190

Requirements and Testing Procedures

Guidance

9.1 Processes and mechanisms for restricting physical access to cardholder data are defined and understood.

Defined Approach Requirements

Defined Approach Testing Procedures

9.1.1 All security policies and operational
procedures that are identified in Requirement 9 are:9.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures identified in Requirement 9
are managed in accordance with all elements
specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 9 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 9.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 9.
While it is important to define the specific policies
or procedures called out in Requirement 9, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives.
Policies and procedures, including updates, areactively communicated to all affected personnel,
and are supported by operating procedures
describing how to perform activities.

March 2022
Page 191

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.1.2 Roles and responsibilities for performing
activities in Requirement 9 are documented,
assigned, and understood.

9.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 9 are
documented and assigned.

Customized Approach Objective

9.1.2.b Interview personnel with responsibility for
performing activities in Requirement 9 to verify thatroles and responsibilities are assigned as
documented and are understood.

Day-to-day responsibilities for performing all theactivities in Requirement 9 are allocated. Personnel
are accountable for successful, continuous
operation of these requirements.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, personnel may not be aware of their
day-to-day responsibilities, and critical activities
may not occur.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
A method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 192

Requirements and Testing Procedures

Guidance

9.2 Physical access controls manage entry into facilities and systems containing cardholder data.

Defined Approach Requirements

Defined Approach Testing Procedures

9.2.1 Appropriate facility entry controls are in place
to restrict physical access to systems in the CDE.

9.2.1 Observe entry controls and interview
responsible personnel to verify that physicalsecurity controls are in place to restrict access tosystems in the CDE.

Customized Approach Objective
System components in the CDE cannot bephysically accessed by unauthorized personnel.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeWithout physical access controls, unauthorized
persons could potentially gain access to the CDE
and sensitive information, or could alter system
configurations, introduce vulnerabilities into the
network, or destroy or steal equipment. Therefore,
the purpose of this requirement is that physicalaccess to the CDE is controlled via physicalsecurity controls such as badge readers or othermechanisms such as lock and key.
Good Practice
Whichever mechanism meets this requirement, it
must be sufficient for the organization to verify
that only authorized personnel are granted
access.
ExamplesFacility entry controls include physical security
controls at each computer room, data center, andother physical areas with systems in the CDE. It
can also include badge readers or other devices
that manage physical access controls, such as
lock and key with a current list of all individuals
holding the keys.

March 2022
Page 193

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.2.1.1 Individual physical access to sensitive areas
within the CDE is monitored with either video
cameras or physical access control mechanisms (orboth) as follows:

9.2.1.1.a Observe locations where individual
physical access to sensitive areas within the CDE
occurs to verify that either video cameras or
physical access control mechanisms (or both) arein place to monitor the entry and exit points.

•

Entry and exit points to/from sensitive areas
within the CDE are monitored.

•

Monitoring devices or mechanisms are protectedfrom tampering or disabling.

•

Collected data is reviewed and correlated withother entries.

•

Collected data is stored for at least threemonths, unless otherwise restricted by law.

9.2.1.1.b Observe locations where individual
physical access to sensitive areas within the CDE
occurs to verify that either video cameras or
physical access control mechanisms (or both) areprotected from tampering or disabling.
9.2.1.1.c Observe the physical access control
mechanisms and/or examine video cameras andinterview responsible personnel to verify that:

Customized Approach Objective•

Trusted, verifiable records are maintained ofindividual physical entry to, and exit from, sensitive
areas.

Collected data from video cameras and/or
physical access control mechanisms isreviewed and correlated with other entries.

•

Collected data is stored for at least threemonths.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeMaintaining details of individuals entering andexiting the sensitive areas can help withinvestigations of physical breaches by identifying
individuals that physically accessed the sensitive
areas, as well as when they entered and exited.
Good Practice
Whichever mechanism meets this requirement, it
should effectively monitor all entry and exit points
to sensitive areas.
Criminals attempting to gain physical access tosensitive areas will often try to disable or bypass
the monitoring controls. To protect these controls
from tampering, video cameras could bepositioned so they are out of reach and/or bemonitored to detect tampering. Similarly, physicalaccess control mechanisms could be monitoredor have physical protections installed to prevent
them from being damaged or disabled bymalicious individuals.

March 2022
Page 194

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.2.2 Physical and/or logical controls are
implemented to restrict use of publicly accessible
network jacks within the facility.

9.2.2 Interview responsible personnel and observe
locations of publicly accessible network jacks toverify that physical and/or logical controls are inplace to restrict access to publicly accessible
network jacks within the facility.

Customized Approach Objective
Unauthorized devices cannot connect to the entity’s
network from public areas within the facility.

Defined Approach Requirements

Defined Approach Testing Procedures

9.2.3 Physical access to wireless access points,
gateways, networking/communications hardware,and telecommunication lines within the facility is
restricted.

9.2.3 Interview responsible personnel and observe
locations of hardware and lines to verify thatphysical access to wireless access points,
gateways, networking/communications hardware,and telecommunication lines within the facility is
restricted.

Customized Approach Objective
Physical networking equipment cannot be accessedby unauthorized personnel.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeRestricting access to network jacks (or network
ports) will prevent malicious individuals fromplugging into readily available network jacks andgaining access to the CDE or systems connectedto the CDE.
Good Practice
Whether logical or physical controls, or a
combination of both, are used, they should
prevent an individual or device that is not explicitly
authorized from being able to connect to the
network.
ExamplesMethods to meet this requirement include network
jacks located in public areas and areas accessible
to visitors could be disabled and only enabled
when network access is explicitly authorized.
Alternatively, processes could be implemented toensure that visitors are escorted at all times inareas with active network jacks.
PurposeWithout appropriate physical security over accessto wireless components and devices, andcomputer networking and telecommunications
equipment and lines, malicious users could gain
access to the entity’s network resources.
Additionally, they could connect their own devices
to the network to gain unauthorized access to the
CDE or systems connected to the CDE.
Additionally, securing networking andcommunications hardware prevents malicious
users from intercepting network traffic or
physically connecting their own devices to wired
network resources.

March 2022
Page 195

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.2.4 Access to consoles in sensitive areas is
restricted via locking when not in use.

9.2.4 Observe a system administrator’s attempt tolog into consoles in sensitive areas and verify thatthey are “locked” to prevent unauthorized use.

Customized Approach Objective

Guidance
PurposeLocking console login screens prevents
unauthorized persons from gaining access tosensitive information, altering system
configurations, introducing vulnerabilities into the
network, or destroying records.

Physical consoles within sensitive areas cannot be
used by unauthorized personnel.
9.3 Physical access for personnel and visitors is authorized and managed.

Defined Approach Requirements

Defined Approach Testing Procedures

9.3.1 Procedures are implemented for authorizing
and managing physical access of personnel to theCDE, including:

9.3.1.a Examine documented procedures to verify
that procedures to authorize and manage physicalaccess of personnel to the CDE are defined inaccordance with all elements specified in thisrequirement.

•

Identifying personnel.

•

Managing changes to an individual’s physicalaccess requirements.

•

Revoking or terminating personnel identification.

•

Limiting access to the identification process or
system to authorized personnel.

Customized Approach Objective

9.3.1.b Observe identification methods, such as ID
badges, and processes to verify that personnel in
the CDE are clearly identified.
9.3.1.c Observe processes to verify that access tothe identification process, such as a badge system,
is limited to authorized personnel.

Requirements for access to the physical CDE aredefined and enforced to identify and authorize
personnel.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeEstablishing procedures for granting, managing,
and removing access when it is no longer needed
ensures non-authorized individuals are prevented
from gaining access to areas containing
cardholder data. In addition, it is important to limit
access to the actual badging system and badging
materials to prevent unauthorized personnel frommaking their own badges and/or setting up theirown access rules.
Good Practice
It is important to visually identify the personnel
that are physically present, and whether theindividual is a visitor or an employee.
ExamplesOne way to identify personnel is to assign thembadges.

March 2022
Page 196

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.3.1.1 Physical access to sensitive areas within the
CDE for personnel is controlled as follows:

9.3.1.1.a Observe personnel in sensitive areas
within the CDE, interview responsible personnel,
and examine physical access control lists to verify
that:

•

Access is authorized and based on individual job
function.

•

Access is revoked immediately upon termination.

•

All physical access mechanisms, such as keys,
access cards, etc., are returned or disabled upon
termination.

Customized Approach Objective
Sensitive areas cannot be accessed byunauthorized personnel.

•

Access to the sensitive area is authorized.

•

Access is required for the individual’s job
function.

9.3.1.1.b Observe processes and interview
personnel to verify that access of all personnel isrevoked immediately upon termination.

Guidance
PurposeControlling physical access to sensitive areas
helps ensure that only authorized personnel witha legitimate business need are granted access.
Good Practice
Where possible, organizations should havepolicies and procedures to ensure that before
personnel leaving the organization, all physicalaccess mechanisms are returned, or disabled assoon as possible upon their departure. This will
ensure personnel cannot gain physical access tosensitive areas once their employment has
ended.

9.3.1.1.c For terminated personnel, examine
physical access controls lists and interview
responsible personnel to verify that all physicalaccess mechanisms (such as keys, access cards,etc.) were returned or disabled.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 197

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.3.2 Procedures are implemented for authorizing
and managing visitor access to the CDE, including:

9.3.2.a Examine documented procedures andinterview personnel to verify procedures aredefined for authorizing and managing visitor
access to the CDE in accordance with all elements
specified in this requirement.

•

Visitors are authorized before entering.

•

Visitors are escorted at all times.

•

Visitors are clearly identified and given a badge
or other identification that expires.

•

Visitor badges or other identification visibly
distinguishes visitors from personnel.

9.3.2.b Observe processes when visitors arepresent in the CDE and interview personnel toverify that visitors are:•

Authorized before entering the CDE.

•

Escorted at all times within the CDE.

Guidance
PurposeVisitor controls are important to reduce the abilityof unauthorized and malicious persons to gain
access to facilities and potentially to cardholder
data.
Visitor controls ensure visitors are identifiable asvisitors so personnel can monitor their activities,
and that their access is restricted to just the
duration of their legitimate visit.

9.3.2.c Observe the use of visitor badges or otheridentification to verify that the badge or otheridentification does not permit unescorted access to
the CDE.
9.3.2.d Observe visitors in the CDE to verify that:

Customized Approach Objective
Requirements for visitor access to the CDE aredefined and enforced. Visitors cannot exceed any
authorized physical access allowed while in the
CDE.

•

Visitor badges or other identification are being
used for all visitors.

•

Visitor badges or identification easily distinguish
visitors from personnel.

9.3.2.e Examine visitor badges or otheridentification and observe evidence in the badging
system to verify visitor badges or otheridentification expires.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 198

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.3.3 Visitor badges or identification are
surrendered or deactivated before visitors leave thefacility or at the date of expiration.

9.3.3 Observe visitors leaving the facility andinterview personnel to verify visitor badges or otheridentification are surrendered or deactivated before
visitors leave the facility or at the date of expiration.
upon departure or expiration.

Customized Approach Objective

Guidance
PurposeEnsuring that visitor badges are returned ordeactivated upon expiry or completion of the visit
prevents malicious persons from using apreviously authorized pass to gain physicalaccess into the building after the visit has ended.

Visitor identification or badges cannot be reused
after expiration.

Defined Approach Requirements

Defined Approach Testing Procedures

9.3.4 A visitor log is used to maintain a physicalrecord of visitor activity within the facility and withinsensitive areas, including:

9.3.4.a Examine the visitor log and interview
responsible personnel to verify that a visitor log isused to record physical access to the facility andsensitive areas.

•

The visitor’s name and the organization
represented.

•

The date and time of the visit.

•

The name of the personnel authorizing physicalaccess.

••Retaining the log for at least three months,
unless otherwise restricted by law.

The visitor’s name and the organization
represented.

•

The personnel authorizing physical access.

•Date and time of visit.

Customized Approach Objective
Records of visitor access that enable theidentification of individuals are maintained.

9.3.4.b Examine the visitor log and verify that thelog contains:

9.3.4.c Examine visitor log storage locations andinterview responsible personnel to verify that thelog is retained for at least three months, unlessotherwise restricted by law.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeA visitor log documenting minimum information
about the visitor is easy and inexpensive tomaintain. It will assist in identifying historicalphysical access to a building or room andpotential access to cardholder data.
Good Practice
When logging the date and time of visit, including
both in and out times is considered a bestpractice, since it provides helpful tracking
information and provides assurance that a visitor
has left at the end of the day. It is also good toverify that a visitor’s ID (driver’s license, etc.)
matches the name they put on the visitor log.

March 2022
Page 199

Requirements and Testing Procedures

Guidance

9.4 Media with cardholder data is securely stored, accessed, distributed, and destroyed.

Defined Approach Requirements

Defined Approach Testing Procedures

9.4.1 All media with cardholder data is physicallysecured.

9.4.1. Examine documentation to verify that theprocedures defined for protecting cardholder data
include controls for physically securing all media.

Customized Approach Objective

PurposeControls for physically securing media areintended to prevent unauthorized persons fromgaining access to cardholder data on any media.
Cardholder data is susceptible to unauthorizedviewing, copying, or scanning if it is unprotected
while it is on removable or portable media, printed
out, or left on someone’s desk.

Media with cardholder data cannot be accessed byunauthorized personnel.
9.4.1.1 Offline media backups with cardholder data
are stored in a secure location.

9.4.1.1.a Examine documentation to verify thatprocedures are defined for physically securing
offline media backups with cardholder data in asecure location.
9.4.1.1.b Examine logs or other documentationand interview responsible personnel at the storage
location to verify that offline media backups are
stored in a secure location.

Customized Approach Objective

PurposeIf stored in a non-secured facility, backups
containing cardholder data may easily be lost,
stolen, or copied for malicious intent.
Good PracticeFor secure storage of backup media, a goodpractice is to store media in an off-site facility,
such as an alternate or backup site or commercial
storage facility.

Offline backups cannot be accessed byunauthorized personnel.

Defined Approach Requirements

Defined Approach Testing Procedures

9.4.1.2 The security of the offline media backup
location(s) with cardholder data is reviewed at least
once every 12 months.

9.4.1.2.a Examine documentation to verify thatprocedures are defined for reviewing the securityof the offline media backup location(s) withcardholder data at least once every 12 months.

Customized Approach Objective
The security controls protecting offline backups areverified periodically by inspection.

PurposeConducting regular reviews of the storage facility
enables the organization to address identified
security issues promptly, minimizing the potential
risk. It is important for the entity to be aware of the
security of the area where media is being stored.

9.4.1.2.b Examine documented procedures, logs,
or other documentation, and interview responsible
personnel at the storage location(s) to verify thatthe storage location’s security is reviewed at least
once every 12 months.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 200

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.4.2 All media with cardholder data is classified inaccordance with the sensitivity of the data.

9.4.2.a Examine documentation to verify thatprocedures are defined for classifying media withcardholder data in accordance with the sensitivityof the data.

Customized Approach Objective

9.4.2.b Examine media logs or otherdocumentation to verify that all media is classified
in accordance with the sensitivity of the data.

Guidance
PurposeMedia not identified as confidential may not beadequately protected or may be lost or stolen.
Good Practice
It is important that media be identified such thatits classification status is apparent. This does notmean however that the media needs to have a“confidential” label.

Media are classified and protected appropriately.

Defined Approach Requirements

Defined Approach Testing Procedures

9.4.3 Media with cardholder data sent outside thefacility is secured as follows:

9.4.3.a Examine documentation to verify thatprocedures are defined for securing media sent
outside the facility in accordance with all elements
specified in this requirement.

•

Media sent outside the facility is logged.

•

Media is sent by secured courier or otherdelivery method that can be accurately tracked.

•

Offsite tracking logs include details about media
location.

Customized Approach Objective

9.4.3.b Interview personnel and examine records
to verify that all media sent outside the facility islogged and sent via secured courier or otherdelivery method that can be tracked.

PurposeMedia may be lost or stolen if sent via a nontrackable method such as regular postal mail. The
use of secure couriers to deliver any media that
contains cardholder data allows organizations to
use their tracking systems to maintain inventory
and location of shipments.

9.4.3.c Examine offsite tracking logs for all media
to verify tracking details are documented.

Media is secured and tracked when transported
outside the facility.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 201

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.4.4 Management approves all media withcardholder data that is moved outside the facility(including when media is distributed to individuals).

9.4.4.a Examine documentation to verify thatprocedures are defined to ensure that media
moved outside the facility is approved bymanagement.

Customized Approach Objective
Media cannot leave a facility without the approval of
accountable personnel.

9.4.4.b Examine offsite media tracking logs andinterview responsible personnel to verify thatproper management authorization is obtained forall media moved outside the facility (including
media distributed to individuals).

Guidance
PurposeWithout a firm process for ensuring that all media
movements are approved before the media isremoved from secure areas, the media would not
be tracked or appropriately protected, and its
location would be unknown, leading to lost or
stolen media.

Applicability Notes
Individuals approving media movements shouldhave the appropriate level of management authority
to grant this approval. However, it is not specificallyrequired that such individuals have “manager” aspart of their title.

Defined Approach Requirements

Defined Approach Testing Procedures

9.4.5 Inventory logs of all electronic media withcardholder data are maintained.

9.4.5.a Examine documentation to verify thatprocedures are defined to maintain electronic
media inventory logs.

Customized Approach Objective

PurposeWithout careful inventory methods and storage
controls, stolen or missing electronic media could
go unnoticed for an indefinite amount of time.

9.4.5.b Examine electronic media inventory logs
and interview responsible personnel to verify thatlogs are maintained.

Accurate inventories of stored electronic media aremaintained.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 202

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.4.5.1 Inventories of electronic media withcardholder data are conducted at least once every
12 months.

9.4.5.1.a Examine documentation to verify thatprocedures are defined to conduct inventories ofelectronic media with cardholder data at least once
every 12 months.

Customized Approach Objective
Media inventories are verified periodically.

Guidance
PurposeWithout careful inventory methods and storage
controls, stolen or missing electronic media could
go unnoticed for an indefinite amount of time.

9.4.5.1.b Examine electronic media inventory logs
and interview personnel to verify that electronic
media inventories are performed at least once
every 12 months.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 203

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.4.6 Hard-copy materials with cardholder data aredestroyed when no longer needed for business orlegal reasons, as follows:

9.4.6.a Examine the periodic media destruction
policy to verify that procedures are defined todestroy hard-copy media with cardholder datawhen no longer needed for business or legal
reasons in accordance with all elements specified
in this requirement.

•

Materials are cross-cut shredded, incinerated, or
pulped so that cardholder data cannot bereconstructed.

•

Materials are stored in secure storage containers
prior to destruction.

Customized Approach Objective

9.4.6.b Observe processes and interview
personnel to verify that hard-copy materials arecross-cut shredded, incinerated, or pulped suchthat cardholder data cannot be reconstructed.
9.4.6.c Observe storage containers used formaterials that contain information to be destroyed
to verify that the containers are secure.

Cardholder data cannot be recovered from media
that has been destroyed or which is pending
destruction.

Applicability Notes

Guidance
PurposeIf steps are not taken to destroy information
contained on hard-copy media before disposal,
malicious individuals may retrieve informationfrom the disposed media, leading to a datacompromise. For example, malicious individuals
may use a technique known as “dumpster diving,”
where they search through trashcans and recycle
bins looking for hard-copy materials withinformation they can use to launch an attack.
Securing storage containers used for materials
that are going to be destroyed prevents sensitive
information from being captured while thematerials are being collected.
Good PracticeConsider “to-be-shredded” containers with a lockthat prevents access to its contents or thatphysically prevent access to the inside of thecontainer.
Further Information
See NIST Special Publication 800-88, Revision 1:
Guidelines for Media Sanitization.

These requirements for media destruction when thatmedia is no longer needed for business or legal
reasons are separate and distinct from PCI DSS
Requirement 3.2.1, which is for securely deleting
cardholder data when no longer needed per theentity’s cardholder data retention policies.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 204

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.4.7 Electronic media with cardholder data is
destroyed when no longer needed for business orlegal reasons via one of the following:

9.4.7.a Examine the periodic media destruction
policy to verify that procedures are defined todestroy electronic media when no longer needed
for business or legal reasons in accordance with allelements specified in this requirement.

•

The electronic media is destroyed.

•

The cardholder data is rendered unrecoverable
so that it cannot be reconstructed.

Customized Approach Objective
Cardholder data cannot be recovered from media
that has been erased or destroyed.

9.4.7.b Observe the media destruction process
and interview responsible personnel to verify thatelectronic media with cardholder data is destroyed
via one of the methods specified in thisrequirement.

Applicability Notes
These requirements for media destruction when thatmedia is no longer needed for business or legal
reasons are separate and distinct from PCI DSS
Requirement 3.2.1, which is for securely deleting
cardholder data when no longer needed per theentity’s cardholder data retention policies.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf steps are not taken to destroy information
contained on electronic media when no longer
needed, malicious individuals may retrieve
information from the disposed media, leading to adata compromise. For example, malicious
individuals may use a technique known as“dumpster diving,” where they search throughtrashcans and recycle bins looking for information
they can use to launch an attack.
Good Practice
The deletion function in most operating systems
allows deleted data to be recovered, so instead, adedicated secure deletion function or application
should be used to make data unrecoverable.
ExamplesMethods for securely destroying electronic media
include secure wiping in accordance withindustry-accepted standards for secure deletion,
degaussing, or physical destruction (such as
grinding or shredding hard disks).
Further Information
See NIST Special Publication 800-88, Revision 1:
Guidelines for Media Sanitization

March 2022
Page 205

Requirements and Testing Procedures

Guidance

9.5 Point-of-interaction (POI) devices are protected from tampering and unauthorized substitution.

Defined Approach Requirements

Defined Approach Testing Procedures

9.5.1 POI devices that capture payment card data
via direct physical interaction with the payment card
form factor are protected from tampering andunauthorized substitution, including the following:

9.5.1 Examine documented policies andprocedures to verify that processes are definedthat include all elements specified in thisrequirement.

•

Maintaining a list of POI devices.

•

Periodically inspecting POI devices to look fortampering or unauthorized substitution.

•

Training personnel to be aware of suspicious
behavior and to report tampering or
unauthorized substitution of devices.

Customized Approach Objective
The entity has defined procedures to protect andmanage point of interaction devices. Expectations,controls, and oversight for the management andprotection of POI devices are defined and adhered
to by affected personnel.

Applicability Notes

Purpose
Criminals attempt to steal payment card data bystealing and/or manipulating card-reading devices
and terminals. Criminals will try to steal devices
so they can learn how to break into them, andthey often try to replace legitimate devices withfraudulent devices that send them payment card
data every time a card is entered.
They will also try to add “skimming” components
to the outside of devices, which are designed tocapture payment card data before it enters thedevice—for example, by attaching an additionalcard reader on top of the legitimate card reader
so that the payment card data is captured twice:once by the criminal’s component and then by thedevice’s legitimate component. In this way,transactions may still be completed without
interruption while the criminal is “skimming” thepayment card data during the process.
Further Information
Additional best practices on skimming prevention
are available on the PCI SSC website.

These requirements apply to deployed POI devices
used in card-present transactions (that is, apayment card form factor such as a card that isswiped, tapped, or dipped). This requirement is notintended to apply to manual PAN key-entry
components such as computer keyboards.
This requirement is recommended, but not required,for manual PAN key-entry components such as
computer keyboards.
This requirement does not apply to commercial offthe-shelf (COTS) devices (for example,
smartphones or tablets), which are mobile
merchant-owned devices designed for mass-market
distribution.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 206

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.5.1.1 An up-to-date list of POI devices ismaintained, including:

9.5.1.1.a Examine the list of POI devices to verify it
includes all elements specified in this requirement.

•

Make and model of the device.

•

Location of device.

•Device serial number or other methods of unique
identification.

Customized Approach Objective

9.5.1.1.b Observe POI devices and device
locations and compare to devices in the list toverify that the list is accurate and up to date.
9.5.1.1.c Interview personnel to verify the list of
POI devices is updated when devices are added,
relocated, decommissioned, etc.

The identity and location of POI devices is recorded
and known at all times.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeKeeping an up-to-date list of POI devices helps
an organization track where devices aresupposed to be and quickly identify if a device ismissing or lost.
Good Practice
The method for maintaining a list of devices may
be automated (for example, a devicemanagement system) or manual (for example,
documented in electronic or paper records). For
on-the-road devices, the location may include thename of the personnel to whom the device isassigned.
ExamplesMethods to maintain device locations include
identifying the address of the site or facility where
the device is located.

March 2022
Page 207

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.5.1.2 POI device surfaces are periodicallyinspected to detect tampering and unauthorized
substitution.

9.5.1.2.a Examine documented procedures toverify processes are defined for periodic
inspections of POI device surfaces to detect
tampering and unauthorized substitution.

Customized Approach Objective
Point of Interaction Devices cannot be tampered
with, substituted without authorization, or haveskimming attachments installed without timely
detection.

9.5.1.2.b Interview responsible personnel andobserve inspection processes to verify:•

Personnel are aware of procedures forinspecting devices.

•

All devices are periodically inspected forevidence of tampering and unauthorized
substitution.

Guidance
PurposeRegular inspections of devices will helporganizations detect tampering more quickly via
external evidence—for example, the addition of acard skimmer—or replacement of a device,
thereby minimizing the potential impact of using
fraudulent devices.
Good Practice
Methods for periodic inspection include checking
the serial number or other device characteristics
and comparing the information to the list of POI
devices to verify the device has not beenswapped with a fraudulent device.
ExamplesThe type of inspection will depend on the device.
For instance, photographs of devices known to be
secure can be used to compare a device’s current
appearance with its original appearance to see
whether it has changed. Another option may be touse a secure marker pen, such as a UV lightmarker, to mark device surfaces and device
openings so any tampering or replacement will beapparent. Criminals will often replace the outercasing of a device to hide their tampering, andthese methods may help to detect such activities.
Device vendors may also provide security
guidance and “how to” guides to help determine
whether the device has been subject totampering.
Signs that a device might have been tamperedwith or substituted include:•
Unexpected attachments or cables plugged
into the device.
•

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Missing or changed security labels.

•

Broken or differently colored casing.

•

Changes to the serial number or otherexternal markings.

March 2022
Page 208

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.5.1.2.1 The frequency of periodic POI device
inspections and the type of inspections performed isdefined in the entity’s targeted risk analysis, which is
performed according to all elements specified in
Requirement 12.3.1.

9.5.1.2.1.a Examine the entity’s targeted risk
analysis for the frequency of periodic POI device
inspections and type of inspections performed toverify the risk analysis was performed inaccordance with all elements specified in
Requirement 12.3.1.

Customized Approach Objective
POI devices are inspected at a frequency that
addresses the entity’s risk.

9.5.1.2.1.b Examine documented results ofperiodic device inspections and interview
personnel to verify that the frequency and type of
POI device inspections performed match what isdefined in the entity’s targeted risk analysis
conducted for this requirement.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeEntities are best placed to determine thefrequency of POI device inspections based on theenvironment in which the device operates.
Good Practice
The frequency of inspections will depend on
factors such as the location of a device andwhether the device is attended or unattended. For
example, devices left in public areas without
supervision by the organization’s personnel might
have more frequent inspections than devices kept
in secure areas or supervised when accessible tothe public. In addition, many POI vendors include
guidance in their user documentation about how
often POI devices should be checked, and forwhat – entities should consult their vendors’
documentation and incorporate thoserecommendations into their periodic inspections.

March 2022
Page 209

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

9.5.1.3 Training is provided for personnel in POI
environments to be aware of attempted tamperingor replacement of POI devices, and includes:

9.5.1.3.a Review training materials for personnel in
POI environments to verify they include all
elements specified in this requirement.

•

Verifying the identity of any third-party persons
claiming to be repair or maintenance personnel,
before granting them access to modify or
troubleshoot devices.

•

Procedures to ensure devices are not installed,
replaced, or returned without verification.

•

Being aware of suspicious behavior arounddevices.

•

Reporting suspicious behavior and indications ofdevice tampering or substitution to appropriate
personnel.

9.5.1.3.b Interview personnel in POI environments
to verify they have received training and know theprocedures for all elements specified in thisrequirement.

Customized Approach Objective
Personnel are knowledgeable about the types ofattacks against POI devices, the entity’s technicaland procedural countermeasures, and can accessassistance and guidance when required.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Criminals will often pose as authorized
maintenance personnel to gain access to POI
devices.
Good Practice
Personnel training should include being alert toand questioning anyone who shows up to do POI
maintenance to ensure they are authorized andhave a valid work order, including any agents,
maintenance or repair personnel, technicians,
service providers, or other third parties. All third
parties requesting access to devices should
always be verified before being provided
access—for example, by checking withmanagement or phoning the POI maintenancecompany, such as the vendor or acquirer, forverification. Many criminals will try to foolpersonnel by dressing for the part (for example,
carrying toolboxes and dressed in work apparel),and could also be knowledgeable about locationsof devices, so personnel should be trained toalways follow procedures.
Another trick that criminals use is to send a “new”
POI device with instructions for swapping it with alegitimate device and “returning” the legitimate
device. The criminals may even provide return
postage to their specified address. Therefore,
personnel should always verify with their manager
or supplier that the device is legitimate and camefrom a trusted source before installing it or using it
for business.
(continued on next page)

March 2022
Page 210

Requirements and Testing Procedures

Guidance
ExamplesSuspicious behavior that personnel should beaware of includes attempts by unknown persons
to unplug or open devices.
Ensuring personnel are aware of mechanisms forreporting suspicious behavior and who to reportsuch behavior to—for example, a manager or
security officer—will help reduce the likelihood
and potential impact of a device being tamperedwith or substituted.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 211

Regularly Monitor and Test Networks
Requirement 10: Log and Monitor All Access to System Components and Cardholder Data
Sections
10.1 Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined anddocumented.
10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.3 Audit logs are protected from destruction and unauthorized modifications.
10.4 Audit logs are reviewed to identify anomalies or suspicious activity.
10.5 Audit log history is retained and available for analysis.
10.6 Time-synchronization mechanisms support consistent time settings across all systems.
10.7 Failures of critical security control systems are detected, reported, and responded to promptly.
Overview
Logging mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise.
The presence of logs on all system components and in the cardholder data environment (CDE) allows thorough tracking, alerting, and analysis
when something does go wrong. Determining the cause of a compromise is difficult, if not impossible, without system activity logs.
This requirement applies to user activities, including those by employees, contractors, consultants, and internal and external vendors, and otherthird parties (for example, those providing support or maintenance services).
These requirements do not apply to user activity of consumers (cardholders).
Refer to Appendix G for definitions of PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 212

Requirements and Testing Procedures

Guidance

10.1 Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documented.

Defined Approach Requirements

Defined Approach Testing Procedures

10.1.1 All security policies and operational
procedures that are identified in Requirement 10
are:

10.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures identified in Requirement
10 are managed in accordance with all elements
specified in this requirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 10 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 10.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 10.
While it is important to define the specific policies
or procedures called out in Requirement 10, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives.

March 2022
Page 213

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.1.2 Roles and responsibilities for performing
activities in Requirement 10 are documented,
assigned, and understood.

10.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 10 are
documented and assigned.

Customized Approach Objective
Day-to-day responsibilities for performing all theactivities in Requirement 10 are allocated.
Personnel are accountable for successful,continuous operation of these requirements.

10.1.2.b Interview personnel with responsibility for
performing activities in Requirement 10 to verify
that roles and responsibilities are assigned as
defined and are understood.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, personnel may not be aware of their
day-to-day responsibilities and critical activities
may not occur.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 214Requirements and Testing Procedures

Guidance

10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.

Defined Approach Requirements

Defined Approach Testing Procedures

10.2.1 Audit logs are enabled and active for all
system components and cardholder data.

10.2.1 Interview the system administrator andexamine system configurations to verify that audit
logs are enabled and active for all systemcomponents.

Customized Approach Objective
Records of all activities affecting systemcomponents and cardholder data are captured.

Defined Approach Requirements

Defined Approach Testing Procedures

10.2.1.1 Audit logs capture all individual user
access to cardholder data.

10.2.1.1 Examine audit log configurations and log
data to verify that all individual user access to
cardholder data is logged.

Customized Approach Objective
Records of all individual user access to cardholder
data are captured.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeAudit logs must exist for all system components.
Audit logs send alerts the system administrator,
provides data to other monitoring mechanisms,
such as intrusion-detection systems (IDS) andsecurity information and event monitoring
systems (SIEM) tools, and provide a history trail
for post-incident investigation.
Logging and analyzing security-relevant events
enable an organization to identify and trace
potentially malicious activities.
Good Practice
When an entity considers which information torecord in their logs, it is important to rememberthat information stored in audit logs is sensitiveand should be protected per requirements in thisstandard. Care should be taken to only store
essential information in the audit logs to minimize
risk.
PurposeIt is critical to have a process or system that links
user access to system components accessed.
Malicious individuals could obtain knowledge of auser account with access to systems in the CDE,
or they could create a new, unauthorized accountto access cardholder data.
Good Practice
A record of all individual access to cardholder
data can identify which accounts may have been
compromised or misused.

March 2022
Page 215

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.2.1.2 Audit logs capture all actions taken by any
individual with administrative access, including any
interactive use of application or system accounts.

10.2.1.2 Examine audit log configurations and log
data to verify that all actions taken by any
individual with administrative access, including any
interactive use of application or system accounts,
are logged.

Customized Approach Objective
Records of all actions performed by individuals withelevated privileges are captured.

Defined Approach Requirements

Defined Approach Testing Procedures

10.2.1.3 Audit logs capture all access to audit logs.

10.2.1.3 Examine audit log configurations and log
data to verify that access to all audit logs is
captured.

Customized Approach Objective
Records of all access to audit logs are captured.

Defined Approach Requirements

Defined Approach Testing Procedures

10.2.1.4 Audit logs capture all invalid logical accessattempts.

10.2.1.4 Examine audit log configurations and log
data to verify that invalid logical access attempts
are captured.

Customized Approach Objective

Guidance
PurposeAccounts with increased access privileges, suchas the “administrator” or “root” account, have thepotential to significantly impact the security or
operational functionality of a system. Without alog of the activities performed, an organization iscannot trace any issues resulting from an
administrative mistake or misuse of privilege backto the specific action and account.
Definitions
Accounts with administrative access are those
assigned with specific privileges or abilities forthat account to manage systems, networks,
and/or applications. The functions or activities
considered to be administrative are beyond those
performed by regular users as part of routine
business functions.
Purpose
Malicious users often attempt to alter audit logs tohide their actions. A record of access allows anorganization to trace any inconsistencies or
potential tampering of the logs to an individual
account. Having logs identify changes, additions,and deletions to the audit logs can help retrace
steps made by unauthorized personnel.
Purpose
Malicious individuals will often perform multiple
access attempts on targeted systems. Multiple
invalid login attempts may be an indication of anunauthorized user’s attempts to “brute force” orguess a password.

Records of all invalid access attempts are captured.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 216

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.2.1.5 Audit logs capture all changes to
identification and authentication credentials
including, but not limited to:

10.2.1.5 Examine audit log configurations and log
data to verify that changes to identification andauthentication credentials are captured inaccordance with all elements specified in thisrequirement.

•

Creation of new accounts.

•

Elevation of privileges.

•

All changes, additions, or deletions to accounts
with administrative access.

Guidance
Purpose
Logging changes to authentication credentials(including elevation of privileges, additions, anddeletions of accounts with administrative access)provides residual evidence of activities.
Malicious users may attempt to manipulate
authentication credentials to bypass them orimpersonate a valid account.

Customized Approach Objective
Records of all changes to identification andauthentication credentials are captured.

Defined Approach Requirements

Defined Approach Testing Procedures

10.2.1.6 Audit logs capture the following:

10.2.1.6 Examine audit log configurations and log
data to verify that all elements specified in thisrequirement are captured.

•

All initialization of new audit logs, and•All starting, stopping, or pausing of the existing
audit logs.

PurposeTurning off or pausing audit logs before
performing illicit activities is common practice formalicious users who want to avoid detection.
Initialization of audit logs could indicate that that auser disabled the log function to hide theiractions.

Customized Approach Objective
Records of all changes to audit log activity status
are captured.

Defined Approach Requirements

Defined Approach Testing Procedures

10.2.1.7 Audit logs capture all creation and deletionof system-level objects.

10.2.1.7 Examine audit log configurations and log
data to verify that creation and deletion of systemlevel objects is captured.

Customized Approach Objective
Records of alterations that indicate a system has
been modified from its intended functionality arecaptured.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Purpose
Malicious software, such as malware, often
creates or replaces system-level objects on thetarget system to control a particular function oroperation on that system. By logging whensystem-level objects are created or deleted, it will
be easier to determine whether suchmodifications were authorized.

March 2022
Page 217

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.2.2 Audit logs record the following details foreach auditable event:10.2.2 Interview personnel and examine audit log
configurations and log data to verify that allelements specified in this requirement are included
in log entries for each auditable event (from10.2.1.1 through 10.2.1.7).

•

User identification.

•

Type of event.

•

Date and time.

•

Success and failure indication.

•

Origination of event.

•

Identity or name of affected data, systemcomponent, resource, or service (for example,
name and protocol).

Guidance
PurposeBy recording these details for the auditable events
at 10.2.1.1 through 10.2.1.7, a potential
compromise can be quickly identified, with
sufficient detail to facilitate following up on
suspicious activities.

Customized Approach Objective
Sufficient data to be able to identify successful andfailed attempts and who, what, when, where, andhow for each event listed in requirement 10.2.1 arecaptured.
10.3 Audit logs are protected from destruction and unauthorized modifications.

Defined Approach Requirements

Defined Approach Testing Procedures

10.3.1 Read access to audit logs files is limited tothose with a job-related need.

10.3.1 Interview system administrators andexamine system configurations and privileges toverify that only individuals with a job-related needhave read access to audit log files.

Customized Approach Objective
Stored activity records cannot be accessed byunauthorized personnel.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeAudit log files contain sensitive information, andread access to the log files must be limited only tothose with a valid business need. This accessincludes audit log files on the originating systems
as well as anywhere else they are stored.
Good Practice
Adequate protection of the audit logs includes
strong access control that limits access to logs
based on “need to know” only and the use ofphysical or network segregation to make the logs
harder to find and modify.

March 2022
Page 218

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.3.2 Audit log files are protected to prevent
modifications by individuals.

10.3.2 Examine system configurations andprivileges and interview system administrators toverify that current audit log files are protected frommodifications by individuals via access control
mechanisms, physical segregation, and/or network
segregation.

Customized Approach Objective
Stored activity records cannot be modified bypersonnel.

Defined Approach Requirements

Defined Approach Testing Procedures

10.3.3 Audit log files, including those for externalfacing technologies, are promptly backed up to asecure, central, internal log server(s) or other media
that is difficult to modify.

10.3.3 Examine backup configurations or log files
to verify that current audit log files, including thosefor external-facing technologies, are promptly
backed up to a secure, central, internal log
server(s) or other media that is difficult to modify.

Customized Approach Objective
Stored activity records are secured and preserved ina central location to prevent unauthorized
modification.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeOften a malicious individual who has entered the
network will try to edit the audit logs to hide theiractivity. Without adequate protection of audit logs,
their completeness, accuracy, and integrity
cannot be guaranteed, and the audit logs can berendered useless as an investigation tool after acompromise. Therefore, audit logs should beprotected on the originating systems as well as
anywhere else they are stored.
Good Practice
Entities should attempt to prevent logs from being
exposed in public-accessible locations.
Purpose
Promptly backing up the logs to a centralized log
server or media that is difficult to alter keeps thelogs protected, even if the system generating thelogs becomes compromised.
Writing logs from external-facing technologies
such as wireless, network security controls, DNS,
and mail servers, reduces the risk of those logs
being lost or altered.
Good Practice
Each entity determines the best way to back up
log files, whether via one or more centralized log
servers or other secure media. Logs may be
written directly, offloaded, or copied from external
systems to the secure internal system or media.

March 2022
Page 219

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.3.4 File integrity monitoring or change-detection
mechanisms is used on audit logs to ensure thatexisting log data cannot be changed without
generating alerts.

10.3.4 Examine system settings, monitored files,
and results from monitoring activities to verify theuse of file integrity monitoring or change-detection
software on audit logs.

Customized Approach Objective
Stored activity records cannot be modified without
an alert being generated.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeFile integrity monitoring or change-detection
systems check for changes to critical files andnotify when such changes are identified. For file
integrity monitoring purposes, an entity usuallymonitors files that do not regularly change, butwhen changed, indicate a possible compromise.
Good PracticeSoftware used to monitor changes to audit logs
should be configured to provide alerts when
existing log data or files are changed or deleted.
However, new log data being added to an audit
log should not generate an alert.

March 2022
Page 220Requirements and Testing Procedures

Guidance

10.4 Audit logs are reviewed to identify anomalies or suspicious activity.

Defined Approach Requirements

Defined Approach Testing Procedures

10.4.1 The following audit logs are reviewed at least
once daily:

10.4.1.a Examine security policies and proceduresto verify that processes are defined for reviewing
all elements specified in this requirement at least
once daily.

•

All security events.

•

Logs of all system components that store,
process, or transmit CHD and/or SAD.

•

Logs of all critical system components.

•

Logs of all servers and system components that
perform security functions (for example, network
security controls, intrusion-detection
systems/intrusion-prevention systems (IDS/IPS),
authentication servers).

10.4.1.b Observe processes and interview
personnel to verify that all elements specified inthis requirement are reviewed at least once daily

Customized Approach Objective
Potentially suspicious or anomalous activities arequickly identified to minimize impact.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeMany breaches occur months before being
detected. Regular log reviews mean incidents canbe quickly identified and proactively addressed.
Good Practice
Checking logs daily (7 days a week, 365 days ayear, including holidays) minimizes the amount oftime and exposure of a potential breach. Log
harvesting, parsing, and alerting tools, centralized
log management systems, event log analyzers,
and security information and event management(SIEM) solutions are examples of automated toolsthat can be used to meet this requirement.
Daily review of security events—for example,
notifications or alerts that identify suspicious oranomalous activities—as well as logs from criticalsystem components, and logs from systems that
perform security functions, such as firewalls,
IDS/IPS, file integrity monitoring (FIM) systems,
etc., is necessary to identify potential issues.
The determination of “security event” will vary foreach organization and may include consideration
for the type of technology, location, and functionof the device. Organizations may also wish to
maintain a baseline of “normal” traffic to help
identify anomalous behavior.
An entity that uses third-party service providers to
perform log review services is responsible toprovide context about the entity’s environment tothe service providers, so it understands theentity’s environment, has a baseline of “normal”
traffic for the entity, and can detect potential
security issues and provide accurate exceptions
and anomaly notifications.

March 2022
Page 221Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.4.1.1 Automated mechanisms are used toperform audit log reviews.

10.4.1.1 Examine log review mechanisms andinterview personnel to verify that automatedmechanisms are used to perform log reviews.

Customized Approach Objective
Potentially suspicious or anomalous activities are
identified via a repeatable and consistentmechanism.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Defined Approach Requirements

Defined Approach Testing Procedures

10.4.2 Logs of all other system components (those
not specified in Requirement 10.4.1) are reviewed
periodically.

10.4.2.a Examine security policies and proceduresto verify that processes are defined for reviewing
logs of all other system components periodically.

Customized Approach Objective

10.4.2.b Examine documented results of log
reviews and interview personnel to verify that log
reviews are performed periodically.

Guidance
PurposeManual log reviews are difficult to perform, evenfor one or two systems, due to the amount of log
data that is generated. However, using log
harvesting, parsing, and alerting tools, centralized
log management systems, event log analyzers,
and security information and event management(SIEM) solutions can help facilitate the process byidentifying log events that need to be reviewed.
Good Practice
The entity should keep logging tools aligned withany changes in their environment by periodicallyreviewing tool settings and updating settings toreflect any changes.
Purpose
Periodic review of logs for all other systemcomponents (not specified in Requirement 10.4.1)
helps to identify indications of potential issues or
attempts to access critical systems via less-criticalsystems.

Potentially suspicious or anomalous activities forother system components (not included in 10.4.1)
are reviewed in accordance with the entity’s
identified risk.

Applicability Notes
This requirement is applicable to all other in-scope
system components not included in Requirement
10.4.1.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 222

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.4.2.1 The frequency of periodic log reviews forall other system components (not defined in
Requirement 10.4.1) is defined in the entity’s
targeted risk analysis, which is performed
according to all elements specified in Requirement
12.3.1

10.4.2.1.a Examine the entity’s targeted risk
analysis for the frequency of periodic log reviews
for all other system components (not defined in
Requirement 10.4.1) to verify the risk analysis was
performed in accordance with all elements
specified at Requirement 12.3.1.

Customized Approach Objective

10.4.2.1.b Examine documented results of periodic
log reviews of all other system components (notdefined in Requirement 10.4.1) and interview
personnel to verify log reviews are performed at
the frequency specified in the entity’s targeted risk
analysis performed for this requirement.

Log reviews for lower-risk system components are
performed at a frequency that addresses the entity’srisk.

Guidance
PurposeEntities can determine the optimum period toreview these logs based on criteria such as thecomplexity of each entity’s environment, thenumber of types of systems that are required tobe evaluated, and the functions of such systems.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 223

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.4.3 Exceptions and anomalies identified during
the review process are addressed.

10.4.3.a Examine security policies and proceduresto verify that processes are defined for addressing
exceptions and anomalies identified during thereview process.

Customized Approach Objective

10.4.3.b Observe processes and interview
personnel to verify that, when exceptions andanomalies are identified, they are addressed.

Suspicious or anomalous activities are addressed.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf exceptions and anomalies identified during the
log-review process are not investigated, the entity
may be unaware of unauthorized and potentiallymalicious activities occurring within their network.
Good Practice
Entities should consider how to address thefollowing when developing their processes fordefining and managing exceptions andanomalies:•

How log review activities are recorded,•

How to rank and prioritize exceptions andanomalies,•

What procedures should be in place to reportand escalate exceptions and anomalies, and•

Who is responsible for investigating and forany remediation tasks.

March 2022
Page 224

Requirements and Testing Procedures

Guidance

10.5 Audit log history is retained and available for analysis.

Defined Approach Requirements

Defined Approach Testing Procedures

10.5.1 Retain audit log history for at least 12
months, with at least the most recent three months
immediately available for analysis.

10.5.1.a Examine documentation to verify that thefollowing is defined:•

Audit log retention policies.

•

Procedures for retaining audit log history for atleast 12 months, with at least the most recent
three months immediately available online.

10.5.1.b Examine configurations of audit log
history, interview personnel and examine audit logs
to verify that audit logs history is retained for atleast 12 months.

Customized Approach Objective
Historical records of activity are available
immediately to support incident response and areretained for at least 12 months.

10.5.1.c Interview personnel and observe
processes to verify that at least the most recent
three months’ audit log history is immediately
available for analysis.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Good Practice
Retaining historical audit logs for at least 12
months is necessary because compromises often
go unnoticed for significant lengths of time.
Having centrally stored log history allows
investigators to better determine the length oftime a potential breach was occurring, and thepossible system(s) impacted. By having threemonths of logs immediately available, an entity
can quickly identify and minimize impact of a data
breach.
ExamplesMethods that allow logs to be immediately
available include storing logs online, archiving
logs, or restoring logs quickly from backups.

March 2022
Page 225

Requirements and Testing Procedures

Guidance

10.6 Time-synchronization mechanisms support consistent time settings across all systems.

Defined Approach Requirements

Defined Approach Testing Procedures

10.6.1 System clocks and time are synchronizedusing time-synchronization technology.

10.6.1 Examine system configuration settings toverify that time-synchronization technology isimplemented and kept current.

Customized Approach Objective
Common time is established across all systems.

Applicability Notes
Keeping time-synchronization technology current
includes managing vulnerabilities and patching thetechnology according to PCI DSS Requirements
6.3.1 and 6.3.3.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeTime synchronization technology is used tosynchronize clocks on multiple systems. Whenclocks are not properly synchronized, it can bedifficult, if not impossible, to compare log files
from different systems and establish an exact
sequence of events, which is crucial for forensic
analysis following a breach.
For post-incident forensics teams, the accuracy
and consistency of time across all systems andthe time of each activity are critical in determining
how the systems were compromised.
ExamplesNetwork Time Protocol (NTP) is one example oftime-synchronization technology.

March 2022
Page 226

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.6.2 Systems are configured to the correct andconsistent time as follows:

10.6.2 Examine system configuration settings foracquiring, distributing, and storing the correct timeto verify the settings are configured in accordancewith all elements specified in this requirement.

•

One or more designated time servers are in use.

•

Only the designated central time server(s)receives time from external sources.

•

Time received from external sources is based on
International Atomic Time or Coordinated
Universal Time (UTC).

•The designated time server(s) accept time
updates only from specific industry-accepted
external sources.

•

Where there is more than one designated time
server, the time servers peer with one another tokeep accurate time.

•

Internal systems receive time information only
from designated central time server(s).

Guidance
PurposeUsing reputable time servers is a criticalcomponent of the time synchronization process.
Accepting time updates from specific, industryaccepted external sources helps prevent a
malicious individual from changing time settingson systems.
Good Practice
Another option to prevent unauthorized use ofinternal time servers is to encrypt updates with asymmetric key and create access control lists thatspecify the IP addresses of client machines thatwill be provided with the time updates.

Customized Approach Objective
The time on all systems is accurate and consistent.

Defined Approach Requirements

Defined Approach Testing Procedures

10.6.3 Time synchronization settings and data areprotected as follows:

10.6.3.a Examine system configurations and timesynchronization settings to verify that access totime data is restricted to only personnel with abusiness need.

•

Access to time data is restricted to only
personnel with a business need.

•

Any changes to time settings on critical systems
are logged, monitored, and reviewed.

Customized Approach Objective

10.6.3.b Examine system configurations and timesynchronization settings and logs and observe
processes to verify that any changes to time
settings on critical systems are logged, monitored,
and reviewed.

PurposeAttackers will try to change time configurations tohide their activity. Therefore, restricting the ability
to change or modify time synchronization
configurations or the system time toadministrators will lessen the probability of an
attacker successfully changing time
configurations.

System time settings cannot be modified byunauthorized personnel.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 227

Requirements and Testing Procedures

Guidance

10.7 Failures of critical security control systems are detected, reported, and responded to promptly.

Defined Approach Requirements

Defined Approach Testing Procedures

10.7.1 Additional requirement for service
providers only: Failures of critical security control
systems are detected, alerted, and addressed
promptly, including but not limited to failure of thefollowing critical security control systems:

10.7.1.a Additional testing procedure forservice provider assessments only: Examine
documentation to verify that processes are definedfor the prompt detection and addressing of failuresof critical security control systems, including but
not limited to failure of all elements specified in thisrequirement.

•

Network security controls.

•

IDS/IPS.

•

FIM.

•

Anti-malware solutions.

•Physical access controls.

•

Logical access controls.

•

Audit logging mechanisms.

•

Segmentation controls (if used).

10.7.1.b Additional testing procedure forservice provider assessments only: Observe
detection and alerting processes and interview
personnel to verify that failures of critical security
control systems are detected and reported, andthat failure of a critical security control results in thegeneration of an alert.

PurposeWithout formal processes to detect and alert
when critical security controls fail, failures may goundetected for extended periods and provide
attackers ample time to compromise systemcomponents and steal account data from the
CDE.
Good PracticeThe specific types of failures may vary, dependingon the function of the device system component
and technology in use. Typical failures include asystem ceasing to perform its security function or
not functioning in its intended manner, such as afirewall erasing all its rules or going offline.

Customized Approach Objective
Failures in critical security control systems arepromptly identified and addressed.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.
This requirement will be superseded byRequirement 10.7.2 as of 31 March 2025.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 228

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.7.2 Failures of critical security control systems
are detected, alerted, and addressed promptly,
including but not limited to failure of the following
critical security control systems:

10.7.2.a Examine documentation to verify thatprocesses are defined for the prompt detection andaddressing of failures of critical security control
systems, including but not limited to failure of allelements specified in this requirement.

•

Network security controls.

•

IDS/IPS.

•

Change-detection mechanisms.

•

Anti-malware solutions.

•Physical access controls.

•

Logical access controls.

•

Audit logging mechanisms.

•

Segmentation controls (if used).

•

Audit log review mechanisms.

•

Automated security testing tools (if used).

10.7.2.b Observe detection and alerting processes
and interview personnel to verify that failures ofcritical security control systems are detected andreported, and that failure of a critical security
control results in the generation of an alert.

Guidance
PurposeWithout formal processes to detect and alert
when critical security controls fail, failures may goundetected for extended periods and provide
attackers ample time to compromise systemcomponents and steal account data from the
CDE.
Good PracticeThe specific types of failures may vary, dependingon the function of the device system component
and technology in use. However, typical failures
include a system no longer performing its security
function or not functioning in its intended
manner—for example, a firewall erasing its rules
or going offline.

Customized Approach Objective
Failures in critical security control systems arepromptly identified and addressed.

Applicability Notes
This requirement applies to all entities, including
service providers, and will supersede Requirement
10.7.1 as of 31 March 2025. It includes two
additional critical security control systems not in
Requirement 10.7.1.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 229

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

10.7.3 Failures of any critical security controls
systems are responded to promptly, including but
not limited to:

10.7.3.a Examine documentation and interview
personnel to verify that processes are defined andimplemented to respond to a failure of any criticalsecurity control system and include at least allelements specified in this requirement.

•

Restoring security functions.

•

Identifying and documenting the duration (dateand time from start to end) of the security failure.

•

Identifying and documenting the cause(s) of
failure and documenting required remediation.

10.7.3.b Examine records to verify that failures ofcritical security control systems are documented toinclude:•Identifying and addressing any security issues
that arose during the failure.

•

Identification of cause(s) of the failure.

••

Determining whether further actions are required
as a result of the security failure.

Duration (date and time start and end) of the
security failure.

••

Implementing controls to prevent the cause of
failure from reoccurring.

Details of the remediation required to address
the root cause.

•

Resuming monitoring of security controls.

Guidance
PurposeIf alerts from failures of critical security control
systems are not responded to quickly andeffectively, attackers may use this time to insert
malicious software, gain control of a system, or
steal data from the entity’s environment.
Good Practice
Documented evidence (for example, records
within a problem management system) should
provide support that processes and procedures
are in place to respond to security failures. In
addition, personnel should be aware of their
responsibilities in the event of a failure. Actions
and responses to the failure should be captured in
the documented evidence.

Customized Approach Objective
Failures of critical security control systems areanalyzed, contained, and resolved, and security
controls restored to minimize impact. Resulting
security issues are addressed, and measures taken
to prevent reoccurrence.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider until 31 March 2025,
after which this requirement will apply to all entities.
This is a current v3.2.1 requirement that applies toservice providers only. However, this requirement is
a best practice for all other entities until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 230

Requirement 11:

Test Security of Systems and Networks Regularly
Sections

11.1
11.2
11.3
11.4
11.5
11.6

Processes and mechanisms for regularly testing security of systems and networks are defined and understood.
Wireless access points are identified and monitored, and unauthorized wireless access points are addressed.
External and internal vulnerabilities are regularly identified, prioritized, and addressed.
External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected.
Network intrusions and unexpected file changes are detected and responded to.
Unauthorized changes on payment pages are detected and responded to.
Overview

Vulnerabilities are being discovered continually by malicious individuals and researchers, and being introduced by new software. Systemcomponents, processes, and bespoke and custom software should be tested frequently to ensure security controls continue to reflect achanging environment.
Refer to Appendix G for definitions of PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 231

Requirements and Testing Procedures

Guidance

11.1 Processes and mechanisms for regularly testing security of systems and networks are defined and understood.

Defined Approach Requirements

Defined Approach Testing Procedures

11.1.1 All security policies and operational
procedures that are identified in Requirement 11are:

11.1.1 Examine documentation and interview
personnel to verify that security policies andoperational procedures are managed inaccordance with all elements specified in thisrequirement.

•

Documented.

•

Kept up to date.

•

In use.

•Known to all affected parties.

Customized Approach Objective
Expectations, controls, and oversight for meeting
activities within Requirement 11 are defined andadhered to by affected personnel. All supporting
activities are repeatable, consistently applied, andconform to management’s intent.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRequirement 11.1.1 is about effectively managing
and maintaining the various policies andprocedures specified throughout Requirement 11.
While it is important to define the specific policies
or procedures called out in Requirement 11, it isequally important to ensure they are properly
documented, maintained, and disseminated.
Good Practice
It is important to update policies and proceduresas needed to address changes in processes,
technologies, and business objectives. For thisreason, consider updating these documents assoon as possible after a change occurs and not
only on a periodic cycle.
Definitions
Security policies define the entity’s security
objectives and principles. Operational procedures
describe how to perform activities, and define thecontrols, methods, and processes that are
followed to achieve the desired result in aconsistent manner and in accordance with policy
objectives.

March 2022
Page 232

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.1.2 Roles and responsibilities for performing
activities in Requirement 11 are documented,
assigned, and understood.

11.1.2.a Examine documentation to verify that
descriptions of roles and responsibilities for
performing activities in Requirement 11 are
documented and assigned.

Customized Approach Objective
Day-to-day responsibilities for performing all theactivities in Requirement 11 are allocated.
Personnel are accountable for successful,continuous operation of these requirements.

11.1.2.b Interview personnel with responsibility for
performing activities in Requirement 11 to verify
that roles and responsibilities are assigned as
documented and are understood.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf roles and responsibilities are not formallyassigned, personnel may not be aware of their
day-to-day responsibilities and critical activities
may not occur.
Good Practice
Roles and responsibilities may be documented
within policies and procedures or maintained
within separate documents.
As part of communicating roles andresponsibilities, entities can consider having
personnel acknowledge their acceptance andunderstanding of their assigned roles andresponsibilities.
ExamplesA method to document roles and responsibilities
is a responsibility assignment matrix that includes
who is responsible, accountable, consulted, andinformed (also called a RACI matrix).

March 2022
Page 233

Requirements and Testing Procedures

Guidance

11.2 Wireless access points are identified and monitored, and unauthorized wireless access points are addressed.

Defined Approach Requirements

Defined Approach Testing Procedures

11.2.1 Authorized and unauthorized wireless accesspoints are managed as follows:

11.2.1.a Examine policies and procedures to verify
processes are defined for managing both
authorized and unauthorized wireless accesspoints with all elements specified in thisrequirement.

•

The presence of wireless (Wi-Fi) access points is
tested for,•All authorized and unauthorized wireless accesspoints are detected and identified,•

Testing, detection, and identification occurs atleast once every three months.

•

If automated monitoring is used, personnel are
notified via generated alerts.

11.2.1.b Examine the methodology(ies) in use andthe resulting documentation, and interview
personnel to verify processes are defined to detectand identify both authorized and unauthorized
wireless access points in accordance with allelements specified in this requirement.
11.2.1.c Examine wireless assessment results andinterview personnel to verify that wirelessassessments were conducted in accordance withall elements specified in this requirement.

Customized Approach Objective

11.2.1.d If automated monitoring is used, examine
configuration settings to verify the configuration will
generate alerts to notify personnel.

Unauthorized wireless access points are identified
and addressed periodically.

Purpose
Implementation and/or exploitation of wirelesstechnology within a network are common paths
for malicious users to gain unauthorized access tothe network and cardholder data. Unauthorized
wireless devices could be hidden within or
attached to a computer or other systemcomponent. These devices could also be
attached directly to a network port, to a network
device such as a switch or router, or inserted as awireless interface card inside a systemcomponent.
If a wireless device or network is installed without
a company’s knowledge, it can allow an attacker
to enter the network easily and “invisibly.”
Detecting and removing such unauthorizedaccess points reduces the duration and likelihoodof such devices being leveraged for an attack.
Good PracticeThe size and complexity of an environment will
dictate the appropriate tools and processes to be
used to provide sufficient assurance that a rogue
wireless access point has not been installed in theenvironment.
(continued on next page)

Applicability Notes
The requirement applies even when a policy existsthat prohibits the use of wireless technology sinceattackers do not read and follow company policy.
Methods used to meet this requirement must be
sufficient to detect and identify both authorized andunauthorized devices, including unauthorized
devices attached to devices that themselves areauthorized.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 234

Requirements and Testing Procedures

Guidance
For example, performing a detailed physicalinspection of a single stand-alone retail kiosk in a
shopping mall, where all communication
components are contained within tamper-resistantand tamper-evident casings, may be sufficient toprovide assurance that a rogue wireless accesspoint has not been attached or installed.
However, in an environment with multiple nodes(such as in a large retail store, call center, serverroom or data center), detailed physical inspection
can be difficult. In this case, multiple methods
may be combined, such as performing physicalsystem inspections in conjunction with the resultsof a wireless analyzer.
Definitions
This is also referred to as rogue access point
detection.
ExamplesMethods that may be used include but are notlimited to wireless network scans, physical/logicalinspections of system components andinfrastructure, network access control (NAC), or
wireless IDS/IPS. NAC and wireless IDS/IPS are
examples of automated monitoring tools.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 235

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.2.2 An inventory of authorized wireless accesspoints is maintained, including a documented
business justification.

11.2.2 Examine documentation to verify that aninventory of authorized wireless access points ismaintained, and a business justification is
documented for all authorized wireless accesspoints.

Customized Approach Objective
Unauthorized wireless access points are not
mistaken for authorized wireless access points.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeAn inventory of authorized wireless access points
can help administrators quickly respond when
unauthorized wireless access points are detected.
This helps to proactively minimize the exposure of
CDE to malicious individuals.
Good PracticeIf using a wireless scanner, it is equally importantto have a defined list of known access points
which, while not attached to the company’s
network, will usually be detected during a scan.
These non-company devices are often found in
multi-tenant buildings or businesses located near
one another. However, it is important to verify thatthese devices are not connected to the entity’s
network port or through another networkconnected device and given an SSID resemblinga nearby business. Scan results should note suchdevices and how it was determined that thesedevices could be “ignored.” In addition, detectionof any unauthorized wireless access points thatare determined to be a threat to the CDE should
be managed following the entity’s incident
response plan per Requirement 12.10.1.

March 2022
Page 236

Requirements and Testing Procedures

Guidance

11.3 External and internal vulnerabilities are regularly identified, prioritized, and addressed.

Defined Approach Requirements

Defined Approach Testing Procedures

11.3.1 Internal vulnerability scans are performed asfollows:

11.3.1.a Examine internal scan report results fromthe last 12 months to verify that internal scansoccurred at least once every three months in themost recent 12-month period.

•

At least once every three months.

•

High-risk and critical vulnerabilities (per theentity’s vulnerability risk rankings defined at
Requirement 6.3.1) are resolved.

•

Rescans are performed that confirm all highrisk and critical vulnerabilities (as noted above)
have been resolved.

•

Scan tool is kept up to date with latest
vulnerability information.

•

Scans are performed by qualified personnel andorganizational independence of the tester exists.

Customized Approach Objective
The security posture of all system components isverified periodically using automated tools designed
to detect vulnerabilities operating inside the
network. Detected vulnerabilities are assessed andrectified based on a formal risk assessment
framework.(continued on next page)

11.3.1.b Examine internal scan report results fromeach scan and rescan run in the last 12 months toverify that all high-risk and critical vulnerabilities(identified in PCI DSS Requirement 6.3.1) areresolved.
11.3.1.c Examine scan tool configurations andinterview personnel to verify that the scan tool is
kept up to date with the latest vulnerability
information.
11.3.1.d Interview responsible personnel to verify
that the scan was performed by a qualified internal
resource(s) or qualified external third party and thatorganizational independence of the tester exists.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeIdentifying and addressing vulnerabilities promptly
reduces the likelihood of a vulnerability being
exploited and the potential compromise of asystem component or cardholder data.
Vulnerability scans conducted at least every threemonths provide this detection and identification.
Good Practice
Vulnerabilities posing the greatest risk to theenvironment (for example, ranked high or criticalper Requirement 6.3.1) should be resolved withthe highest priority.
Multiple scan reports can be combined for thequarterly scan process to show that all systems
were scanned and all applicable vulnerabilities
were resolved as part of the three-monthvulnerability scan cycle. However, additional,
documentation may be required to verify nonremediated vulnerabilities are in the process of
being resolved.
While scans are required at least once every
three months, more frequent scans arerecommended depending on the network
complexity, frequency of change, and types ofdevices, software, and operating systems used.
Definitions
A vulnerability scan is a combination of
automated tools, techniques, and/or methods run
against external and internal devices and servers,
designed to expose potential vulnerabilities inapplications, operating systems, and network
devices that could be found and exploited bymalicious individuals.

March 2022
Page 237

Requirements and Testing Procedures

Guidance

Applicability Notes
It is not required to use a QSA or ASV to conduct
internal vulnerability scans.
Internal vulnerability scans can be performed byqualified, internal staff that are reasonably
independent of the system component(s) being
scanned (for example, a network administrator
should not be responsible for scanning the network),
or an entity may choose to have internal
vulnerability scans performed by a firm specializing
in vulnerability scanning.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 238

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.3.1.1 All other applicable vulnerabilities (those
not ranked as high-risk or critical per the entity’svulnerability risk rankings defined at Requirement
6.3.1) are managed as follows:

11.3.1.1.a Examine the entity’s targeted risk
analysis that defines the risk for addressing allother applicable vulnerabilities (those not ranked
as high-risk or critical per the entity’s vulnerability
risk rankings at Requirement 6.3.1) to verify therisk analysis was performed in accordance with allelements specified at Requirement 12.3.1.

•

Addressed based on the risk defined in theentity’s targeted risk analysis, which is
performed according to all elements specified
in Requirement 12.3.1.

•

Rescans are conducted as needed.

Customized Approach Objective
Lower ranked vulnerabilities (lower than high orcritical) are addressed at a frequency in accordancewith the entity’s risk.

Guidance
PurposeAll vulnerabilities, regardless of criticality, provide
a potential avenue of attack and must therefore
be addressed periodically, with the vulnerabilities
that expose the most risk addressed more quickly
to limit the potential window of attack.

11.3.1.1.b Interview responsible personnel andexamine internal scan report results or otherdocumentation to verify that all other applicablevulnerabilities (those not ranked as high-risk or
critical per the entity’s vulnerability risk rankings at
Requirement 6.3.1) are addressed based on therisk defined in the entity’s targeted risk analysis,
and that the scan process includes rescans asneeded to confirm the vulnerabilities have beenaddressed.

Applicability Notes
The timeframe for addressing lower-risk
vulnerabilities is subject to the results of a risk
analysis per Requirement 12.3.1 that includes(minimally) identification of assets being protected,
threats, and likelihood and/or impact of a threat
being realized.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 239

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.3.1.2 Internal vulnerability scans are performed
via authenticated scanning as follows:

11.3.1.2.a Examine scan tool configurations toverify that authenticated scanning is used forinternal scans, with sufficient privileges, for thosesystems that accept credentials for scanning.

•

Systems that are unable to accept credentials forauthenticated scanning are documented.

•

Sufficient privileges are used for those systems
that accept credentials for scanning.

•If accounts used for authenticated scanning canbe used for interactive login, they are managedin accordance with Requirement 8.2.2.

Customized Approach Objective
Automated tools used to detect vulnerabilities candetect vulnerabilities local to each system, which
are not visible remotely.

11.3.1.2.b Examine scan report results andinterview personnel to verify that authenticatedscans are performed.
11.3.1.2.c If accounts used for authenticatedscanning can be used for interactive login,examine the accounts and interview personnel toverify the accounts are managed following all
elements specified in Requirement 8.2.2.
11.3.1.2.d Examine documentation to verify thatsystems that are unable to accept credentials forauthenticated scanning are defined.

Guidance
PurposeAuthenticated scanning provides greater insight
into an entity’s vulnerability landscape since it can
detect vulnerabilities that unauthenticated scanscannot detect. Attackers may leveragevulnerabilities that an entity is unaware of
because certain vulnerabilities will only bedetected with authenticated scanning.
Authenticated scanning can yield significant
additional information about an organization’svulnerabilities.
Good Practice
The credentials used for these scans should beconsidered highly privileged. They should beprotected and controlled as such, following PCI
DSS Requirements 7 and 8 (except for thoserequirements for multi-factor authentication andapplication and system accounts).

Applicability Notes
The authenticated scanning tools can be either
host-based or network-based.
“Sufficient” privileges are those needed to accesssystem resources such that a thorough scan can be
conducted that detects known vulnerabilities.
This requirement does not apply to systemcomponents that cannot accept credentials forscanning. Examples of systems that may not accept
credentials for scanning include some network andsecurity appliances, mainframes, and containers.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 240Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.3.1.3 Internal vulnerability scans are performed
after any significant change as follows:

11.3.1.3.a Examine change control documentationand internal scan reports to verify that systemcomponents were scanned after any significant
changes.

•

High-risk and critical vulnerabilities (per theentity’s vulnerability risk rankings defined at
Requirement 6.3.1) are resolved.

•

Rescans are conducted as needed.

•

Scans are performed by qualified personnel andorganizational independence of the tester exists(not required to be a QSA or ASV).

Customized Approach Objective
The security posture of all system components isverified following significant changes to the networkor systems, by using automated tools designed todetect vulnerabilities operating inside the network.
Detected vulnerabilities are assessed and rectified
based on a formal risk assessment framework.

11.3.1.3.b Interview personnel and examineinternal scan and rescan reports to verify thatinternal scans were performed after significant
changes and that high-risk and criticalvulnerabilities as defined in Requirement 6.3.1
were resolved.

Guidance
PurposeScanning an environment after any significant
changes ensures that changes were completed
appropriately such that the security of theenvironment was not compromised because of
the change.
Good Practice
Entities should perform scans after significant
changes as part of the change process per
Requirement 6.5.2 and before considering thechange complete. All system components
affected by the change will need to be scanned.

11.3.1.3.c Interview personnel to verify that internalscans are performed by a qualified internal
resource(s) or qualified external third party and thatorganizational independence of the tester exists.

Applicability Notes
Authenticated internal vulnerability scanning per
Requirement 11.3.1.2 is not required for scans
performed after significant changes.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 241

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.3.2 External vulnerability scans are performed asfollows:

11.3.2.a Examine ASV scan reports from the last
12 months to verify that external vulnerability scansoccurred at least once every three months in themost recent 12-month period.

•

At least once every three months.

•

By a PCI SSC Approved Scanning Vendor(ASV).

•

Vulnerabilities are resolved and ASV Program
Guide requirements for a passing scan are met.

•

Rescans are performed as needed to confirm
that vulnerabilities are resolved per the ASVProgram Guide requirements for a passing
scan.

Customized Approach Objective

11.3.2.b Examine the ASV scan report from eachscan and rescan run in the last 12 months to verify
that vulnerabilities are resolved and the ASVProgram Guide requirements for a passing scan
are met.
11.3.2.c Examine the ASV scan reports to verify
that the scans were completed by a PCI SSC
Approved Scanning Vendor (ASV).

This requirement is not eligible for the customized
approach.

Applicability Notes
For initial PCI DSS compliance, it is not required thatfour passing scans be completed within 12 months if
the assessor verifies: 1) the most recent scan result
was a passing scan, 2) the entity has documented
policies and procedures requiring scanning at least
once every three months, and 3) vulnerabilities
noted in the scan results have been corrected asshown in a re-scan(s).

Guidance
PurposeAttackers routinely look for unpatched orvulnerable externally facing servers, which can beleveraged to launch a directed attack.
Organizations must ensure these externally facing
devices are regularly scanned for weaknesses
and that vulnerabilities are patched or remediatedto protect the entity.
Because external networks are at greater risk ofcompromise, external vulnerability scanning mustbe performed at least once every three months by
a PCI SSC Approved Scanning Vendor (ASV).
Good Practice
While scans are required at least once every
three months, more frequent scans arerecommended depending on the network
complexity, frequency of change, and types ofdevices, software, and operating systems used.
Multiple scan reports can be combined to showthat all systems were scanned and that all
applicable vulnerabilities were resolved as part of
the three-month vulnerability scan cycle.
However, additional documentation may berequired to verify non-remediated vulnerabilities
are in the process of being resolved.

(continued on next page)

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 242

Requirements and Testing Procedures

Guidance

However, for subsequent years after the initial PCI
DSS assessment, passing scans at least every threemonths must have occurred.
ASV scanning tools can scan a vast array of
network types and topologies. Any specifics about
the target environment (for example, load balancers,
third-party providers, ISPs, specific configurations,
protocols in use, scan interference) should beworked out between the ASV and scan customer.
Refer to the ASV Program Guide published on the
PCI SSC website for scan customer responsibilities,
scan preparation, etc.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 243

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.3.2.1 External vulnerability scans are performed
after any significant change as follows:

11.3.2.1.a Examine change control documentationand external scan reports to verify that systemcomponents were scanned after any significant
changes.

•

Vulnerabilities that are scored 4.0 or higher by
the CVSS are resolved.

•

Rescans are conducted as needed.

•

Scans are performed by qualified personnel andorganizational independence of the tester exists(not required to be a QSA or ASV).

Customized Approach Objective
The security posture of all system components isverified following significant changes to the networkor systems, by using tools designed to detect
vulnerabilities operating from outside the network.
Detected vulnerabilities are assessed and rectified
based on a formal risk assessment framework.

11.3.2.1.b Interview personnel and examine
external scan and rescan reports to verify thatexternal scans were performed after significant
changes and that vulnerabilities scored 4.0 or
higher by the CVSS were resolved.
11.3.2.1.c Interview personnel to verify thatexternal scans are performed by a qualified
internal resource(s) or qualified external third party
and that organizational independence of the tester
exists.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeScanning an environment after any significant
changes ensures that changes were completed
appropriately such that the security of theenvironment was not compromised because of
the change.
Good Practice
Entities should include the need to perform scans
after significant changes as part of the change
process and before the change is considered
complete. All system components affected by thechange will need to be scanned.

March 2022
Page 244

Requirements and Testing Procedures

Guidance

11.4 External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are corrected.

Defined Approach Requirements

Defined Approach Testing Procedures

11.4.1 A penetration testing methodology is defined,
documented, and implemented by the entity, andincludes:11.4.1 Examine documentation and interview
personnel to verify that the penetration-testing
methodology defined, documented, andimplemented by the entity includes all elements
specified in this requirement.

•

Industry-accepted penetration testing
approaches.

•

Coverage for the entire CDE perimeter andcritical systems.

•

Testing from both inside and outside the
network.

•

Testing to validate any segmentation and scopereduction controls.

•

Application-layer penetration testing to identify,
at a minimum, the vulnerabilities listed in
Requirement 6.2.4.

•

Network-layer penetration tests that encompass
all components that support network functions aswell as operating systems.

•

Review and consideration of threats andvulnerabilities experienced in the last 12 months.

•

Documented approach to assessing andaddressing the risk posed by exploitable
vulnerabilities and security weaknesses foundduring penetration testing.

•

Retention of penetration testing results andremediation activities results for at least 12
months.

Customized Approach Objective
A formal methodology is defined for thoroughtechnical testing that attempts to exploit
vulnerabilities and security weaknesses via
simulated attack methods by a competent manualattacker.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeAttackers spend a lot of time finding external andinternal vulnerabilities to leverage to obtain
access to cardholder data and then to exfiltratethat data. As such, entities need to test their
networks thoroughly, just as an attacker would do.
This testing allows the entity to identify andremediate weakness that might be leveraged tocompromise the entity’s network and data, andthen to take appropriate actions to protect the
network and system components from suchattacks.
Good Practice
Penetration testing techniques will differ based onan organization’s needs and structure and should
be suitable for the tested environment—for
example, fuzzing, injection, and forgery tests
might be appropriate. The type, depth, andcomplexity of the testing will depend on thespecific environment and the needs of theorganization.
Definitions
Penetration tests simulate a real-world attack
situation intending to identify how far an attacker
could penetrate an environment, given differing
amounts of information provided to the tester.
This allows an entity to better understand its
potential exposure and develop a strategy todefend against attacks. A penetration test differsfrom a vulnerability scan, as a penetration test isan active process that usually includes exploiting
identified vulnerabilities.

(continued on next page)

March 2022
Page 245

Requirements and Testing Procedures
Applicability Notes
Testing from inside the network (or “internal
penetration testing”) means testing from both inside
the CDE and into the CDE from trusted anduntrusted internal networks.
Testing from outside the network (or “external
penetration testing”) means testing the exposed
external perimeter of trusted networks, and criticalsystems connected to or accessible to public
network infrastructures.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Scanning for vulnerabilities alone is not apenetration test, nor is a penetration test
adequate if the focus is solely on trying to exploit
vulnerabilities found in a vulnerability scan.
Conducting a vulnerability scan may be one of thefirst steps, but it is not the only step a penetration
tester will perform to plan the testing strategy.
Even if a vulnerability scan does not detect known
vulnerabilities, the penetration tester will often
gain enough knowledge about the system toidentify possible security gaps.
Penetration testing is a highly manual process.
While some automated tools may be used, thetester uses their knowledge of systems to gain
access into an environment. Often the tester will
chain several types of exploits together with thegoal of breaking through layers of defenses. For
example, if the tester finds a way to gain accessto an application server, the tester will then use
the compromised server as a point to stage a new
attack based on the resources to which the server
has access. In this way, a tester can simulate thetechniques used by an attacker to identify areasof potential weakness in the environment. The
testing of security monitoring and detection
methods—for example, to confirm theeffectiveness of logging and file integrity
monitoring mechanisms, should also be
considered.
Further Information
Refer to the Information Supplement: Penetration
Testing Guidance for additional guidance.
Industry-accepted penetration testing approaches
include:The Open Source Security Testing Methodology
and Manual (OSSTMM)
Open Web Application Security Project (OWASP)
penetration testing programs.

March 2022
Page 246

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.4.2 Internal penetration testing is performed:

11.4.2.a Examine the scope of work and resultsfrom the most recent internal penetration test toverify that penetration testing is performed inaccordance with all elements specified in thisrequirement.

•

Per the entity’s defined methodology,•

At least once every 12 months•

After any significant infrastructure or application
upgrade or change•

By a qualified internal resource or qualified
external third-party•

Organizational independence of the tester exists(not required to be a QSA or ASV).

11.4.2.b Interview personnel to verify that theinternal penetration test was performed by aqualified internal resource or qualified external
third-party and that organizational independence ofthe tester exists (not required to be a QSA or
ASV).

Customized Approach Objective
Internal system defenses are verified by technicaltesting according to the entity’s defined
methodology as frequently as needed to address
evolving and new attacks and threats and ensurethat significant changes do not introduce unknown
vulnerabilities.

Defined Approach Requirements

Defined Approach Testing Procedures

11.4.3 External penetration testing is performed:

11.4.3.a Examine the scope of work and resultsfrom the most recent external penetration test toverify that penetration testing is performed
according to all elements specified in thisrequirement.

•

Per the entity’s defined methodology•

At least once every 12 months•

After any significant infrastructure or application
upgrade or change•

By a qualified internal resource or qualified
external third party

Organizational independence of the tester exists(not required to be a QSA or ASV).
(continued on next page)•

11.4.3.b Interview personnel to verify that theexternal penetration test was performed by aqualified internal resource or qualified external
third-party and that organizational independence ofthe tester exists (not required to be a QSA or
ASV).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeInternal penetration testing serves two purposes.
Firstly, just like an external penetration test, it
discovers vulnerabilities and misconfigurations
that could be used by an attacker that had
managed to get some degree of access to theinternal network, whether that is because theattacker is an authorized user conducting
unauthorized activities, or an external attacker
that had managed to penetrate the entity’s
perimeter.
Secondly, internal penetration testing also helps
entities to discover where their change control
process failed by detecting previously unknown
systems. Additionally, it verifies the status ofmany of the controls operating within the CDE.
A penetration test is not truly a “test” because theoutcome of a penetration test is not somethingthat can be classified as a “pass” or a “fail.” Thebest outcome of a test is a catalog ofvulnerabilities and misconfigurations that an entity
did not know about and the penetration tester
found them before an attacker could. A
penetration test that found nothing is typicallyindicative of shortcomings of the penetration
tester, rather than being a positive reflection of
the security posture of the entity.
Good PracticeSome considerations when choosing a qualified
resource to perform penetration testing include:•

Specific penetration testing certifications,which may be an indication of the tester’s skill
level and competence.

(continued on next page)

March 2022
Page 247

Requirements and Testing Procedures
Customized Approach Objective
External system defenses are verified by technicaltesting according to the entity’s defined
methodology as frequently as needed to address
evolving and new attacks and threats, and to ensurethat significant changes do not introduce unknown
vulnerabilities.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Prior experience conducting penetration
testing—for example, the number of years ofexperience, and the type and scope of priorengagements can help confirm whether thetester’s experience is appropriate for theneeds of the engagement.
Further Information
Refer to the Information Supplement: Penetration
Testing Guidance on the PCI SSC website for
additional guidance.

•

March 2022
Page 248

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.4.4 Exploitable vulnerabilities and security
weaknesses found during penetration testing arecorrected as follows:

11.4.4 Examine penetration testing results to verify
that noted exploitable vulnerabilities and security
weaknesses were corrected in accordance with allelements specified in this requirement.

•

In accordance with the entity’s assessment of
the risk posed by the security issue as defined in
Requirement 6.3.1.

•

Penetration testing is repeated to verify thecorrections.

Customized Approach Objective
Vulnerabilities and security weaknesses found while
verifying system defenses are mitigated.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
The results of a penetration test are usually aprioritized list of vulnerabilities discovered by theexercise. Often a tester will have chained anumber of vulnerabilities together to compromisea system component. Remediating thevulnerabilities found by a penetration test
significantly reduces the probability that the same
vulnerabilities will be exploited by a malicious
attacker.
Using the entity’s own vulnerability risk
assessment process (see requirement 6.3.1)
ensures that the vulnerabilities that pose thehighest risk to the entity will be remediated more
quickly.
Good Practice
As part of the entity’s assessment of risk, entities
should consider how likely the vulnerability is to
be exploited and whether there are other controls
present in the environment to reduce the risk.
Any weaknesses that point to PCI DSS
requirements not being met should be addressed.

March 2022
Page 249

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.4.5 If segmentation is used to isolate the CDEfrom other networks, penetration tests are
performed on segmentation controls as follows:

11.4.5.a Examine segmentation controls andreview penetration-testing methodology to verify
that penetration-testing procedures are defined totest all segmentation methods in accordance withall elements specified in this requirement.

•

At least once every 12 months and after any
changes to segmentation controls/methods•

Covering all segmentation controls/methods inuse.

•

According to the entity’s defined penetration
testing methodology.

•

Confirming that the segmentation
controls/methods are operational and effective,
and isolate the CDE from all out-of-scope
systems.

•

Confirming effectiveness of any use of isolation
to separate systems with differing security levels(see Requirement 2.2.3).

•

Performed by a qualified internal resource or
qualified external third party.

•

Organizational independence of the tester exists(not required to be a QSA or ASV).

11.4.5.b Examine the results from the most recent
penetration test to verify the penetration test
covers and addresses all elements specified in thisrequirement.
11.4.5.c Interview personnel to verify that the test
was performed by a qualified internal resource or
qualified external third party and that organizational
independence of the tester exists (not required to
be a QSA or ASV).

Guidance
PurposeWhen an entity uses segmentation controls toisolate the CDE from internal untrusted networks,
the security of the CDE is dependent on thatsegmentation functioning. Many attacks have
involved the attacker moving laterally from what
an entity deemed an isolated network into theCDE. Using penetration testing tools andtechniques to validate that an untrusted network
is indeed isolated from the CDE can alert theentity to a failure or misconfiguration of thesegmentation controls, which can then berectified.
Good PracticeTechniques such as host discovery and portscanning can be used to verify out-of-scope
segments have no access to the CDE.

Customized Approach Objective
If segmentation is used, it is verified periodically bytechnical testing to be continually effective, including
after any changes, in isolating the CDE from all outof-scope systems.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 250

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.4.6 Additional requirement for service
providers only: If segmentation is used to isolate
the CDE from other networks, penetration tests are
performed on segmentation controls as follows:

11.4.6.a Additional testing procedure forservice provider assessments only: Examine
the results from the most recent penetration test toverify that the penetration covers and addressed allelements specified in this requirement.

•

At least once every six months and after any
changes to segmentation controls/methods.

•

Covering all segmentation controls/methods inuse.

•

According to the entity’s defined penetration
testing methodology.

•

Confirming that the segmentation
controls/methods are operational and effective,
and isolate the CDE from all out-of-scope
systems.

•

Confirming effectiveness of any use of isolation
to separate systems with differing security levels(see Requirement 2.2.3).

•

Performed by a qualified internal resource or
qualified external third party.

•

Organizational independence of the tester exists(not required to be a QSA or ASV).

11.4.6.b Additional testing procedure forservice provider assessments only: Interview
personnel to verify that the test was performed bya qualified internal resource or qualified external
third party and that organizational independence ofthe tester exists (not required to be a QSA or
ASV).

Guidance
PurposeService providers typically have access to greater
volumes of cardholder data or can provide an
entry point that can be exploited to thencompromise multiple other entities. Service
providers also typically have larger and more
complex networks that are subject to more
frequent change. The probability of segmentation
controls failing in complex and dynamic networks
is greater in service provider environments.
Validating segmentation controls more frequently
is likely to discover such failings before they canbe exploited by an attacker attempting to pivot
laterally from an out-of-scope untrusted network
to the CDE.
Good Practice
Although the requirement specifies that this scope
validation is carried out at least once every six
months and after significant change, this exercise
should be performed as frequently as possible toensure it remains effective at isolating the CDEfrom other networks.

Customized Approach Objective
If segmentation is used, it is verified by technicaltesting to be continually effective, including after any
changes, in isolating the CDE from out-of-scope
systems.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 251

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.4.7 Additional requirement for multi-tenant
service providers only: Multi-tenant service
providers support their customers for external
penetration testing per Requirement 11.4.3 and11.4.4.

11.4.7 Additional testing procedure for multitenant service providers only: Examine evidence
to verify that multi-tenant service providers support
their customers for external penetration testing per
Requirement 11.4.3 and 11.4.4.

Customized Approach Objective
Multi-tenant service providers support theircustomers’ need for technical testing either by
providing access or evidence that comparable
technical testing has been undertaken.

Guidance
PurposeEntities need to conduct penetration tests inaccordance with PCI DSS to simulate attacker
behavior and discover vulnerabilities in theirenvironment. In shared and cloud environments,
the multi-tenant service provider may beconcerned about the activities of a penetration
tester affecting other customers’ systems.
Multi-tenant service providers cannot forbid
penetration testing because this would leave theircustomers’ systems open to exploitation.
Therefore, multi-tenant service providers must
support customer requests to conduct penetration
testing or for penetration testing results.

Applicability Notes

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 252

Requirements and Testing Procedures

Guidance

This requirement applies only when the entity being
assessed is a multi-tenant service provider.
To meet this requirement, a multi-tenant service
provider may either:•

Provide evidence to its customers to show thatpenetration testing has been performed
according to Requirements 11.4.3 and 11.4.4 on
the customers’ subscribed infrastructure, orProvide prompt access to each of its customers,so customers can perform their own penetration
testing.
Evidence provided to customers can include
redacted penetration testing results but needs toinclude sufficient information to prove that allelements of Requirements 11.4.3 and 11.4.4 havebeen met on the customer’s behalf.
Refer also to Appendix A1: Additional PCI DSS
Requirements for Multi-Tenant Service Providers.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

•

11.5 Network intrusions and unexpected file changes are detected and responded to.

Defined Approach Requirements

Defined Approach Testing Procedures

11.5.1 Intrusion-detection and/or intrusionprevention techniques are used to detect and/or
prevent intrusions into the network as follows:

11.5.1.a Examine system configurations andnetwork diagrams to verify that intrusion-detection
and/or intrusion-prevention techniques are in place
to monitor all traffic:•

All traffic is monitored at the perimeter of the
CDE.

•

All traffic is monitored at critical points in the
CDE.

•

Personnel are alerted to suspectedcompromises.

•

All intrusion-detection and prevention engines,
baselines, and signatures are kept up to date.

•

At the perimeter of the CDE.

•

At critical points in the CDE.

11.5.1.b Examine system configurations andinterview responsible personnel to verify intrusiondetection and/or intrusion-prevention techniques
alert personnel of suspected compromises.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeIntrusion-detection and/or intrusion-prevention
techniques (such as IDS/IPS) compare the traffic
coming into the network with known “signatures”
and/or behaviors of thousands of compromise
types (hacker tools, Trojans, and other malware),and then send alerts and/or stop the attempt as it
happens. Without a proactive approach to detect
unauthorized activity, attacks on (or misuse of)computer resources could go unnoticed for long
periods of time. The impact of an intrusion into the
CDE is, in many ways, a factor of the time that an
attacker has in the environment before being
detected.
(continued on next page)

March 2022
Page 253

Requirements and Testing Procedures
Customized Approach Objective
Mechanisms to detect real-time suspicious oranomalous network traffic that may be indicative ofthreat actor activity are implemented. Alerts
generated by these mechanisms are responded toby personnel, or by automated means that ensurethat system components cannot be compromised asa result of the detected activity.

11.5.1.c Examine system configurations andvendor documentation to verify intrusion-detection
and/or intrusion-prevention techniques are
configured to keep all engines, baselines, andsignatures up to date.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Good PracticeSecurity alerts generated by these techniquesshould be continually monitored, so that theattempted or actual intrusions can be stopped,
and potential damage limited.
Definitions
Critical locations could include, but are not limited
to, network security controls between network
segments (for example, between a DMZ and aninternal network or between an in-scope and outof-scope network) and points protecting
connections between a less trusted and a moretrusted system component.

March 2022
Page 254

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.5.1.1 Additional requirement for service
providers only: Intrusion-detection and/or
intrusion-prevention techniques detect, alert
on/prevent, and address covert malware
communication channels.

11.5.1.1.a Additional testing procedure forservice provider assessments only: Examine
documentation and configuration settings to verify
that methods to detect and alert on/prevent covert
malware communication channels are in place andoperating.
11.5.1.1.b Additional testing procedure forservice provider assessments only: Examine
the entity’s incident-response plan (Requirement
12.10.1) to verify it requires and defines a
response in the event that covert malware
communication channels are detected.

Customized Approach Objective
Mechanisms are in place to detect and alert/prevent
covert communications with command-and-control
systems. Alerts generated by these mechanisms
are responded to by personnel, or by automatedmeans that ensure that such communications areblocked.

11.5.1.1.c Additional testing procedure forservice provider assessments only: Interview
responsible personnel and observe processes toverify that personnel maintain knowledge of covert
malware communication and control techniques
and are knowledgeable about how to respondwhen malware is suspected.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Detecting covert malware communication
attempts (for example, DNS tunneling) can help
block the spread of malware laterally inside a
network and the exfiltration of data. When
deciding where to place this control, entities
should consider critical locations in the network,and likely routes for covert channels.
When malware establishes a foothold in an
infected environment, it often tries to establish acommunication channel to a command-andcontrol (C&C) server. Through the C&C server,
the attacker communicates with and controls
malware on compromised systems to deliver
malicious payloads or instructions, or to initiate
data exfiltration. In many cases, the malware willcommunicate with the C&C server indirectly via
botnets, bypassing monitoring, blocking controls,
and rendering these methods ineffective to detect
the covert channels.
Good Practice
Methods that can help detect and address
malware communications channels include realtime endpoint scanning, egress traffic filtering, an”allow” listing, data loss prevention tools, andnetwork security monitoring tools such as
IDS/IPS. Additionally, DNS queries andresponses are a key data source used by network
defenders in support of incident response as wellas intrusion discovery. When these transactions
are collected for processing and analytics, theycan enable a number of valuable security analytic
scenarios.
It is important that organizations maintain up-todate knowledge of malware modes of operation,
as mitigating these can help detect and limit the
impact of malware in the environment.

March 2022
Page 255

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

11.5.2 A change-detection mechanism (for example,
file integrity monitoring tools) is deployed as follows:

11.5.2.a Examine system settings, monitored files,
and results from monitoring activities to verify theuse of a change-detection mechanism.

••

To alert personnel to unauthorized modification(including changes, additions, and deletions) ofcritical files.
To perform critical file comparisons at least
once weekly.

11.5.2.b Examine settings for the change-detection
mechanism to verify it is configured in accordancewith all elements specified in this requirement.

Customized Approach Objective
Critical files cannot be modified by unauthorized
personnel without an alert being generated.

Applicability Notes
For change-detection purposes, critical files areusually those that do not regularly change, but themodification of which could indicate a systemcompromise or risk of compromise. Changedetection mechanisms such as file integrity
monitoring products usually come pre-configured
with critical files for the related operating system.
Other critical files, such as those for custom
applications, must be evaluated and defined by theentity (that is, the merchant or service provider).

Guidance
PurposeChanges to critical system, configuration, or
content files can be an indicator an attacker hasaccessed an organization’s system. Suchchanges can allow an attacker to take additional
malicious actions, access cardholder data, and/or
conduct activities without detection or record.
A change detection mechanism will detect andevaluate such changes to critical files andgenerate alerts that can be responded to following
defined processes so that personnel can takeappropriate actions.
If not implemented properly and the output of thechange-detection solution monitored, a malicious
individual could add, remove, or alter
configuration file contents, operating system
programs, or application executables.
Unauthorized changes, if undetected, could
render existing security controls ineffective and/or
result in cardholder data being stolen with noperceptible impact to normal processing.
Good Practice
Examples of the types of files that should bemonitored include, but are not limited to:•

System executables.

•

Application executables.

•

Configuration and parameter files.

•

Centrally stored, historical, or archived audit
logs.

Additional critical files determined by entity (forexample, through risk assessment or othermeans).
ExamplesChange-detection solutions such as file integrity
monitoring (FIM) tools check for changes,
additions, and deletions to critical files, and notify
when such changes are detected.

•

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 256

Requirements and Testing Procedures

Guidance

11.6 Unauthorized changes on payment pages are detected and responded to.

Defined Approach Requirements

Defined Approach Testing Procedures

11.6.1 A change- and tamper-detection mechanism
is deployed as follows:

11.6.1.a Examine system settings, monitored
payment pages, and results from monitoring
activities to verify the use of a change- and tamperdetection mechanism.

•

To alert personnel to unauthorized modification(including indicators of compromise, changes,
additions, and deletions) to the HTTP headers
and the contents of payment pages as received
by the consumer browser.

•

The mechanism is configured to evaluate thereceived HTTP header and payment page.

•The mechanism functions are performed asfollows:– At least once every seven days
OR
– Periodically (at the frequency defined in theentity’s targeted risk analysis, which is
performed according to all elements
specified in Requirement 12.3.1).

Customized Approach Objective
E-commerce skimming code or techniques cannot
be added to payment pages as received by the
consumer browser without a timely alert being
generated. Anti-skimming measures cannot be
removed from payment pages without a prompt alert
being generated.

11.6.1.b Examine configuration settings to verify
the mechanism is configured in accordance with allelements specified in this requirement.
11.6.1.c If the mechanism functions are performedat an entity-defined frequency, examine the entity’s
targeted risk analysis for determining the frequency
to verify the risk analysis was performed inaccordance with all elements specified at
Requirement 12.3.1.
11.6.1.d Examine configuration settings andinterview personnel to verify the mechanism
functions are performed either:•

At least once every seven days
OR•

At the frequency defined in the entity’s targetedrisk analysis performed for this requirement.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeMany web pages now rely on assembling objects,
including active content (primarily JavaScript),from multiple internet locations. Additionally, thecontent of many web pages is defined using
content management and tag management
systems that may not be possible to monitor using
traditional change detection mechanisms.
Therefore, the only place to detect changes orindicators of malicious activity is in the consumer
browser as the page is constructed and all
JavaScript interpreted.
By comparing the current version of the HTTP
header and the active content of payment pages
as received by the consumer browser with prior or
known versions, it is possible to detect
unauthorized changes that may indicate askimming attack.
Additionally, by looking for known indicators ofcompromise and script elements or behavior
typical of skimmers, suspicious alerts can beraised.
(continued on next page)

March 2022
Page 257

Requirements and Testing Procedures
Applicability Notes
The intention of this requirement is not that an entity
installs software in the systems or browsers of its
consumers, but rather that the entity uses
techniques such as those described under
Examples in the Guidance column to prevent anddetect unexpected script activities.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Guidance
ExamplesMechanisms that detect and report on changes tothe headers and content of the payment page
include but are not limited to:•Violations of the Content Security Policy (CSP)
can be reported to the entity using the reportto or report-uri CSP directives.

•

Changes to the CSP itself can indicate
tampering.

•

External monitoring by systems that request
and analyze the received web pages (alsoknown as synthetic user monitoring) can
detect changes to JavaScript in payment
pages and alert personnel.

•

Embedding tamper-resistant, tamper-detection
script in the payment page can alert and block
when malicious script behavior is detected.

Reverse proxies and Content Delivery
Networks can detect changes in scripts andalert personnel.
Often, these mechanisms are subscription or
cloud-based, but can also be based on custom
and bespoke solutions.

•Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 258

Maintain an Information Security Policy
Requirement 12: Support Information Security with Organizational Policies and Programs
Sections
12.1 A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known
and current.
12.2 Acceptable use policies for end-user technologies are defined and implemented.
12.3 Risks to the cardholder data environment are formally identified, evaluated, and managed.
12.4 PCI DSS compliance is managed.
12.5 PCI DSS scope is documented and validated.
12.6 Security awareness education is an ongoing activity.
12.7 Personnel are screened to reduce risks from insider threats.
12.8 Risk to information assets associated with third-party service provider (TPSP) relationships is managed.
12.9 Third-party service providers (TPSPs) support their customers’ PCI DSS compliance.
12.10 Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
Overview
The organization’s overall information security policy sets the tone for the whole entity and informs personnel what is expected of them. All
personnel should be aware of the sensitivity of cardholder data and their responsibilities for protecting it.
For the purposes of Requirement 12, “personnel” refers to full-time and part-time employees, temporary employees, contractors, andconsultants with security responsibilities for protecting account data or that can impact the security of account data.
Refer to Appendix G for definitions of PCI DSS terms.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 259

Requirements and Testing Procedures

Guidance

12.1 A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and current.

Defined Approach Requirements

Defined Approach Testing Procedures

12.1.1 An overall information security policy is:

12.1.1 Examine the information security policy andinterview personnel to verify that the overall
information security policy is managed inaccordance with all elements specified in thisrequirement.

•

Established.

•

Published.

•

Maintained.

•

Disseminated to all relevant personnel, as wellas to relevant vendors and business partners.

Customized Approach Objective
The strategic objectives and principles of
information security are defined, adopted, andknown to all personnel.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeAn organization’s overall information security
policy ties to and governs all other policies andprocedures that define protection of cardholder
data.
The information security policy communicatesmanagement’s intent and objectives regarding theprotection of its most valuable assets, including
cardholder data.
Without an information security policy, individuals
will make their own value decisions on thecontrols that are required within the organization
which may result in the organization neither
meeting its legal, regulatory, and contractual
obligations, nor being able to adequately protect
its assets in a consistent manner.
To ensure the policy is implemented, it isimportant that all relevant personnel within theorganization, as well as relevant third parties,
vendors, and business partners are aware of theorganization’s information security policy and their
responsibilities for protecting information assets.
(continued on next page)

March 2022
Page 260

Requirements and Testing Procedures

Guidance
Good PracticeThe security policy for the organization identifies
the purpose, scope, accountability, andinformation that clearly defines the organization’s
position regarding information security.
The overall information security policy differs fromindividual security policies that address specifictechnology or security disciplines. This policy sets
forth the directives for the entire organization
whereas individual security policies align andsupport the overall security policy andcommunicate specific objectives for technology or
security disciplines.
It is important that all relevant personnel within
the organization, as well as relevant third parties,
vendors, and business partners are aware of theorganization’s information security policy and their
responsibilities for protecting information assets.
Definitions“Relevant” for this requirement means that the
information security policy is disseminated tothose with roles applicable to some or all the
topics in the policy, either within the company or
because of services/functions performed by avendor or third party.

Defined Approach Requirements

Defined Approach Testing Procedures

12.1.2 The information security policy is:

12.1.2 Examine the information security policy andinterview responsible personnel to verify the policy
is managed in accordance with all elements
specified in this requirement.

•

Reviewed at least once every 12 months.

•

Updated as needed to reflect changes tobusiness objectives or risks to the environment.

PurposeSecurity threats and associated protection
methods evolve rapidly. Without updating theinformation security policy to reflect relevantchanges, new measures to defend against thesethreats may not be addressed.

Customized Approach Objective
The information security policy continues to reflect
the organization’s strategic objectives andprinciples.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 261

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.1.3 The security policy clearly defines
information security roles and responsibilities for all
personnel, and all personnel are aware of andacknowledge their information security
responsibilities.

12.1.3.a Examine the information security policy toverify that they clearly define information security
roles and responsibilities for all personnel.

Customized Approach Objective

12.1.3.b Interview personnel in various roles toverify they understand their information security
responsibilities.

Guidance
PurposeWithout clearly defined security roles andresponsibilities assigned, there could be misuseof the organization’s information assets orinconsistent interaction with information security
personnel, leading to insecure implementation oftechnologies or use of outdated or insecuretechnologies.

12.1.3.c Examine documented evidence to verify
personnel acknowledge their information security
responsibilities.

Personnel understand their role in protecting theentity’s cardholder data.

Defined Approach Requirements

Defined Approach Testing Procedures

12.1.4 Responsibility for information security isformally assigned to a Chief Information Security
Officer or other information security knowledgeable
member of executive management.

12.1.4 Examine the information security policy toverify that information security is formally assigned
to a Chief Information Security Officer or otherinformation security-knowledgeable member of
executive management.

Customized Approach Objective
A designated member of executive management is
responsible for information security.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeTo ensure someone with sufficient authority andresponsibility is actively managing andchampioning the organization’s information
security program, accountability and responsibility
for information security needs to be assigned at
the executive level within an organization.
Common executive management titles for thisrole include Chief Information Security Officer(CISO) and Chief Security Officer (CSO – to meetthis requirement, the CSO role must be
responsible for information security). These
positions are often at the most senior level ofmanagement and are part of the chief executive
level or C-level, typically reporting to the Chief
Executive Officer or the Board of Directors.
Good Practice
Entities should also consider transition and/or
succession plans for these key personnel to avoid
potential gaps in critical security activities.

March 2022
Page 262

Requirements and Testing Procedures

Guidance

12.2 Acceptable use policies for end-user technologies are defined and implemented.

Defined Approach Requirements

Defined Approach Testing Procedures

12.2.1 Acceptable use policies for end-user
technologies are documented and implemented,
including:

12.2.1 Examine the acceptable use policies for
end-user technologies and interview responsible
personnel to verify processes are documented andimplemented in accordance with all elements
specified in this requirement.

•

Explicit approval by authorized parties.

•

Acceptable uses of the technology.

•

List of products approved by the company for
employee use, including hardware and software.

Customized Approach Objective
The use of end-user technologies is defined andmanaged to ensure authorized usage.

Applicability Notes
Examples of end-user technologies for which
acceptable use policies are expected include, but
are not limited to, remote access and wirelesstechnologies, laptops, tablets, mobile phones, andremovable electronic media, email usage, andInternet usage.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeEnd-user technologies are a significant
investment and may pose significant risk to anorganization if not managed properly. Acceptable
use policies outline the expected behavior frompersonnel when using the organization’s
information technology and reflect theorganization’s risk tolerance
These policies instruct personnel on what they
can and cannot do with company equipment andinstruct personnel on correct and incorrect uses ofcompany Internet and email resources. Suchpolicies can legally protect an organization andallow it to act when the policies are violated.
Good Practice
It is important that usage policies are supported
by technical controls to manage the enforcementof the policies.
Structuring polices as simple “do” and “do not”
requirements that are linked to a purpose canhelp remove ambiguity and provide personnel
with the context for the requirement.

March 2022
Page 263

Requirements and Testing Procedures

Guidance

12.3 Risks to the cardholder data environment are formally identified, evaluated, and managed.

Defined Approach Requirements

Defined Approach Testing Procedures

12.3.1 Each PCI DSS requirement that provides
flexibility for how frequently it is performed (forexample, requirements to be performed periodically)is supported by a targeted risk analysis that is
documented and includes:

12.3.1 Examine documented policies andprocedures to verify a process is defined for
performing targeted risk analyses for each PCI
DSS requirement that provides flexibility for how
frequently the requirement is performed, and thatthe process includes all elements specified in thisrequirement.

•

Identification of the assets being protected.

•

Identification of the threat(s) that the requirement
is protecting against.

•

Identification of factors that contribute to thelikelihood and/or impact of a threat being
realized.

•

Resulting analysis that determines, and includes
justification for, how frequently the requirement
must be performed to minimize the likelihood of
the threat being realized.

•

Review of each targeted risk analysis at least
once every 12 months to determine whether the
results are still valid or if an updated risk analysis
is needed.

•

Performance of updated risk analyses whenneeded, as determined by the annual review.

Customized Approach Objective
Up to date knowledge and assessment of risks to
the CDE are maintained.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeSome PCI DSS requirements allow an entity todefine how frequently an activity is performed
based on the risk to environment. Performing thisrisk analysis according to a methodology ensuresvalidity and consistency with policies andprocedures.
This targeted risk analysis (as opposed to a
traditional enterprise-wide risk assessment)
focuses on those PCI DSS requirements thatallow an entity flexibility about how frequently anentity performs a given control. For this risk
analysis, the entity carefully evaluates each PCI
DSS requirement that provides this flexibility anddetermines the frequency that supports adequate
security for the entity, and the level of risk theentity is willing to accept.
The risk analysis identifies the specific assets,such as the system components and data—for
example, log files, or credentials—that therequirement is intended to protect, as well as thethreat(s) or outcomes that the requirement is
protecting the assets from—for example,
malware, an undetected intruder, or misuse of
credentials. Examples of factors that could
contribute to likelihood or impact include any that
could increase the vulnerability of an asset to athreat—for example, exposure to untrusted
networks, complexity of environment, or high staff
turnover—as well as the criticality of the systemcomponents, or volume and sensitivity of thedata, being protected.
(continued on next page)

March 2022
Page 264

Requirements and Testing Procedures

Guidance
Reviewing the results of these targeted risk
analyses at least once every 12 months and uponchanges that could impact the risk to theenvironment allows the organization to ensure therisk analysis results remain current withorganizational changes and evolving threats,trends, and technologies, and that the selected
frequencies still adequately address the entity’s
risk.
Good PracticeAn enterprise-wide risk assessment, which is apoint-in-time activity that enables entities to
identify threats and associated vulnerabilities, isrecommended, but is not required, for entities todetermine and understand broader and emerging
threats with the potential to negatively impact its
business. This enterprise-wide risk assessment
could be established as part of an overarchingrisk management program that is used as an
input to the annual review of an organization's
overall information security policy (seeRequirement 12.1.1).
Examples of risk-assessment methodologies forenterprise-wide risk assessments include, but are
not limited to, ISO 27005 and NIST SP 800-30.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 265Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.3.2 A targeted risk analysis is performed for each
PCI DSS requirement that the entity meets with thecustomized approach, to include:

12.3.2 Examine the documented targeted riskanalysis for each PCI DSS requirement that theentity meets with the customized approach to verify
that documentation for each requirement exists
and is in accordance with all elements specified inthis requirement.

•

Documented evidence detailing each element
specified in Appendix D: Customized Approach(including, at a minimum, a controls matrix andrisk analysis).

•

Approval of documented evidence by senior
management.

•

Performance of the targeted analysis of risk atleast once every 12 months.

Customized Approach Objective
This requirement is part of the customized approachand must be met for those using the customized
approach.

Applicability Notes
This requirement only applies to entities using a
Customized Approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeA risk analysis following a repeatable and robust
methodology enables an entity to meet thecustomized approach objective.
Definitions
The customized approach to meeting a PCI DSS
requirement allows entities to define the controls
used to meet a given requirement’s stated
Customized Approach Objective in a way that
does not strictly follow the defined requirement.
These controls are expected to at least meet or
exceed the security provided by the definedrequirement and require extensive documentationby the entity using the customized approach.
Further Information
See Appendix D: Customized Approach for
instructions on how to document the required
evidence for the customized approach.
See Appendix E Sample Templates to Support
Customized Approach for templates that entities
may use to document their customized controls.
Note that while use of the templates is optional,
the information specified within each template
must be documented and provided to each
entity’s assessor.

March 2022
Page 266

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.3.3 Cryptographic cipher suites and protocols in
use are documented and reviewed at least once
every 12 months, including at least the following:

12.3.3 Examine documentation for cryptographic
suites and protocols in use and interview personnel
to verify the documentation and review is inaccordance with all elements specified in thisrequirement.

•

An up-to-date inventory of all cryptographic
cipher suites and protocols in use, including
purpose and where used.

•

Active monitoring of industry trends regarding
continued viability of all cryptographic cipher
suites and protocols in use.

•

A documented strategy to respond to anticipatedchanges in cryptographic vulnerabilities.

Customized Approach Objective
The entity is able to respond quickly to any
vulnerabilities in cryptographic protocols or
algorithms, where those vulnerabilities affectprotection of cardholder data.

Applicability Notes
The requirement applies to all cryptographic suites
and protocols used to meet PCI DSS requirements.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeProtocols and encryption strengths may quickly
change or be deprecated due to identification ofvulnerabilities or design flaws. In order to support
current and future data security needs, entities
need to know where cryptography is used andunderstand how they would be able to respondrapidly to changes impacting the strength of theircryptographic implementations.
Good Practice
Cryptographic agility is important to ensure analternative to the original encryption method or
cryptographic primitive is available, with plans to
upgrade to the alternative without significant
change to system infrastructure. For example, if
the entity is aware of when protocols or
algorithms will be deprecated by standards
bodies, it can make proactive plans to upgrade
before the deprecation is impactful to operations.
Definitions“Cryptographic agility” refers to the ability tomonitor and manage the encryption and related
verification technologies deployed across anorganization.
Further Information
Refer to NIST SP 800-131a, Transitioning theUse of Cryptographic Algorithms and Key
Lengths.

March 2022
Page 267

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.3.4 Hardware and software technologies in use
are reviewed at least once every 12 months,
including at least the following:

12.3.4 Examine documentation for the review ofhardware and software technologies in use andinterview personnel to verify that the review is inaccordance with all elements specified in thisrequirement.

•

Analysis that the technologies continue toreceive security fixes from vendors promptly.

•

Analysis that the technologies continue tosupport (and do not preclude) the entity’s PCI
DSS compliance.

•

Documentation of any industry announcements
or trends related to a technology, such as whena vendor has announced “end of life” plans for atechnology.

•

Documentation of a plan, approved by senior
management, to remediate outdated
technologies, including those for which vendors
have announced “end of life” plans.

Customized Approach Objective
The entity’s hardware and software technologies are
up to date and supported by the vendor. Plans toremove or replace all unsupported systemcomponents are reviewed periodically.

Guidance
PurposeHardware and software technologies areconstantly evolving, and organizations need to beaware of changes to the technologies they use,
as well as the evolving threats to thosetechnologies to ensure that they can prepare for,and manage, vulnerabilities in hardware andsoftware that will not be remediated by the vendor
or developer.
Good Practice
Organizations should review firmware versions toensure they remain current and supported by thevendors. Organizations also need to be aware ofchanges made by technology vendors to theirproducts or processes to understand how suchchanges may impact the organization’s use of thetechnology.
Regular reviews of technologies that impact or
influence PCI DSS controls can assist withpurchasing, usage, and deployment strategies,
and ensure controls that rely on thosetechnologies remain effective. These reviews
include, but are not limited to, reviewing
technologies that are no longer supported by thevendor and/or no longer meet the security needsof the organization.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 268

Requirements and Testing Procedures

Guidance

12.4 PCI DSS compliance is managed.

Defined Approach Requirements

Defined Approach Testing Procedures

12.4.1 Additional requirement for service
providers only: Responsibility is established byexecutive management for the protection of
cardholder data and a PCI DSS complianceprogram to include:

12.4.1 Additional testing procedure for service
provider assessments only: Examine
documentation to verify that executive
management has established responsibility for theprotection of cardholder data and a PCI DSS
compliance program in accordance with allelements specified in this requirement.

•

Overall accountability for maintaining PCI DSS
compliance.

•

Defining a charter for a PCI DSS complianceprogram and communication to executive
management.

Purpose
Executive management assignment of PCI DSS
compliance responsibilities ensures executivelevel visibility into the PCI DSS complianceprogram and allows for the opportunity to ask
appropriate questions to determine theeffectiveness of the program and influencestrategic priorities.

Customized Approach Objective
Executives are responsible and accountable forsecurity of cardholder data.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.
Executive management may include C-level
positions, board of directors, or equivalent. The
specific titles will depend on the particularorganizational structure.
Responsibility for the PCI DSS compliance program
may be assigned to individual roles and/or tobusiness units within the organization.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 269

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.4.2 Additional requirement for service
providers only: Reviews are performed at least
once every three months to confirm that personnel
are performing their tasks in accordance with all
security policies and operational procedures.
Reviews are performed by personnel other thanthose responsible for performing the given task andinclude, but are not limited to, the following tasks:

12.4.2.a Additional testing procedure forservice provider assessments only: Examine
policies and procedures to verify that processes
are defined for conducting reviews to confirm that
personnel are performing their tasks in accordancewith all security policies and all operational
procedures, including but not limited to the tasks
specified in this requirement.

•

Daily log reviews.

•

Configuration reviews for network security
controls.

•

Applying configuration standards to new
systems.

••

Responding to security alerts.

At least once every three months.

••

Change-management processes.

By personnel other than those responsible for
performing the given task.

12.4.2.b Additional testing procedure forservice provider assessments only: Interview
responsible personnel and examine records ofreviews to verify that reviews are performed:

Customized Approach Objective
The operational effectiveness of critical PCI DSS
controls is verified periodically by manual inspectionof records.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeRegularly confirming that security policies andprocedures are being followed provides
assurance that the expected controls are active
and working as intended. This requirement isdistinct from other requirements that specify atask to be performed. The objective of thesereviews is not to reperform other PCI DSS
requirements, but to confirm that security
activities are being performed on an ongoingbasis.
Good Practice
These reviews can also be used to verify thatappropriate evidence is being maintained—for
example, audit logs, vulnerability scan reports,
reviews of network security control rulesets—toassist in the entity’s preparation for its next PCI
DSS assessment.
ExamplesLooking at Requirement 1.2.7 as one example,
Requirement 12.4.2 is met by confirming, at least
once every three months, that reviews ofconfigurations of network security controls haveoccurred at the required frequency. On the other
hand, Requirement 1.2.7 is met by reviewing
those configurations as specified in therequirement.

March 2022
Page 270

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.4.2.1 Additional requirement for service
providers only: Reviews conducted in accordancewith Requirement 12.4.2 are documented to include:

12.4.2.1 Additional testing procedure forservice provider assessments only: Examine
documentation from the reviews conducted inaccordance with PCI DSS Requirement 12.4.2 toverify the documentation includes all elements
specified in this requirement.

•

Results of the reviews.

•

Documented remediation actions taken for any
tasks that were found to not be performed at
Requirement 12.4.2.

•

Review and sign-off of results by personnel
assigned responsibility for the PCI DSS
compliance program.

Guidance
PurposeThe intent of these independent checks is toconfirm whether security activities are being
performed on an ongoing basis. These reviews
can also be used to verify that appropriate
evidence is being maintained—for example, audit
logs, vulnerability scan reports, reviews of
network security control rulesets—to assist in theentity’s preparation for its next PCI DSS
assessment.

Customized Approach Objective
Findings from operational effectiveness reviews areevaluated by management; appropriate remediation
activities are implemented.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 271

Requirements and Testing Procedures

Guidance

12.5 PCI DSS scope is documented and validated.

Defined Approach Requirements

Defined Approach Testing Procedures

12.5.1 An inventory of system components that are
in scope for PCI DSS, including a description offunction/use, is maintained and kept current.

12.5.1.a Examine the inventory to verify it includes
all in-scope system components and a descriptionof function/use for each.
12.5.1.b Interview personnel to verify the inventory
is kept current.

Customized Approach Objective
All system components in scope for PCI DSS are
identified and known.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeMaintaining a current list of all systemcomponents will enable an organization to define
the scope of its environment and implement PCI
DSS requirements accurately and efficiently.
Without an inventory, some system components
could be overlooked and be inadvertently
excluded from the organization’s configuration
standards.
Good Practice
If an entity keeps an inventory of all assets, thosesystem components in scope for PCI DSS should
be clearly identifiable among the other assets.
Inventories should include containers or images
that may be instantiated.
Assigning an owner to the inventory helps toensure the inventory stays current.
ExamplesMethods to maintain an inventory include as a
database, as a series of files, or in an inventorymanagement tool.

March 2022
Page 272

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.5.2 PCI DSS scope is documented andconfirmed by the entity at least once every 12
months and upon significant change to the in-scope
environment. At a minimum, the scoping validation
includes:12.5.2.a Examine documented results of scope
reviews and interview personnel to verify that thereviews are performed:•

Identifying all data flows for the various payment
stages (for example, authorization, capture
settlement, chargebacks, and refunds) andacceptance channels (for example, card-present,
card-not-present, and e-commerce).

•

Updating all data-flow diagrams per
Requirement 1.2.4.

•

Identifying all locations where account data isstored, processed, and transmitted, including but
not limited to: 1) any locations outside of thecurrently defined CDE, 2) applications thatprocess CHD, 3) transmissions between
systems and networks, and 4) file backups.

•

At least once every 12 months.

•

After significant changes to the in-scope
environment.

12.5.2.b Examine documented results of scope
reviews performed by the entity to verify that PCI
DSS scoping confirmation activity includes allelements specified in this requirement.

Guidance
PurposeFrequent validation of PCI DSS scope helps toensure PCI DSS scope remains up to date andaligned with changing business objectives, andtherefore that security controls are protecting all
appropriate system components.
Good Practice
Accurate scoping involves critically evaluating the
CDE and all connected system components todetermine the necessary coverage for PCI DSS
requirements. Scoping activities, including carefulanalysis and ongoing monitoring, help to ensurethat in-scope systems are appropriately secured.
When documenting account data locations, theentity can consider creating a table or
spreadsheet that includes the following
information:•

Data stores (databases, files, cloud, etc.),
including the purpose of data storage and theretention period,•

Identifying all system components in the CDE,
connected to the CDE, or that could impact
security of the CDE.

•

Which CHD elements are stored (PAN, expiry
date, cardholder name, and/or any elementsof SAD prior to completion of authorization),•

Identifying all segmentation controls in use andthe environment(s) from which the CDE issegmented, including justification forenvironments being out of scope.

•

How data is secured (type of encryption andstrength, hashing algorithm and strength,
truncation, tokenization),•

Identifying all connections from third-party
entities with access to the CDE.

•

Confirming that all identified data flows, accountdata, system components, segmentation
controls, and connections from third parties withaccess to the CDE are included in scope.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

How access to data stores is logged,
including a description of logging
mechanism(s) in use (enterprise solution,
application level, operating system level,etc.).
(continued on next page)•

March 2022
Page 273

Requirements and Testing Procedures
Customized Approach Objective
PCI DSS scope is verified periodically, and after
significant changes, by comprehensive analysis andappropriate technical measures.

Applicability Notes
This annual confirmation of PCI DSS scope is anactivity expected to be performed by the entity
under assessment, and is not the same, nor is it
intended to be replaced by, the scoping confirmation
performed by the entity’s assessor during theannual assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
In addition to internal systems and networks, allconnections from third-party entities—for
example, business partners, entities providing
remote support services, and other service
providers—need to be identified to determine
inclusion for PCI DSS scope. Once the in-scope
connections have been identified, the applicable
PCI DSS controls can be implemented to reduce
the risk of a third-party connection being used tocompromise an entity’s CDE.
A data discovery tool or methodology can be used
to facilitate identifying all sources and locations of
PAN, and to look for PAN that resides on systems
and networks outside the currently defined CDE
or in unexpected places within the defined CDE—
for example, in an error log or memory dump file.
This approach can help ensure that previously
unknown locations of PAN are detected and that
the PAN is either eliminated or properly secured.
Further Information
For additional guidance, refer to Information
Supplement: Guidance for PCI DSS Scoping and
Network Segmentation.

March 2022
Page 274

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.5.2.1 Additional requirement for service
providers only: PCI DSS scope is documented andconfirmed by the entity at least once every six
months and upon significant change to the in-scope
environment. At a minimum, the scoping validation
includes all the elements specified in Requirement
12.5.2.

12.5.2.1.a Additional testing procedure forservice provider assessments only: Examine
documented results of scope reviews and interview
personnel to verify that reviews per Requirement
12.5.2 are performed:

Customized Approach Objective
The accuracy of PCI DSS scope is verified to becontinuously accurate by comprehensive analysis
and appropriate technical measures.

•

At least once every six months, and•After significant changes

12.5.2.1.b Additional testing procedure forservice provider assessments only: Examine
documented results of scope reviews to verify thatscoping validation includes all elements specified
in Requirement 12.5.2.

Guidance
PurposeService providers typically have access to greater
volumes of cardholder data than do merchants, orcan provide an entry point that can be exploited tothen compromise multiple other entities. Service
providers also typically have larger and more
complex networks that are subject to more
frequent change. The probability of overlookedchanges to scope in complex and dynamic
networks is greater in service providers’environments.
Validating PCI DSS scope more frequently islikely to discover such overlooked changes before
they can be exploited by an attacker.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 275

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.5.3 Additional requirement for service
providers only: Significant changes toorganizational structure result in a documented(internal) review of the impact to PCI DSS scope
and applicability of controls, with results
communicated to executive management.

12.5.3.a Additional testing procedure forservice provider assessments only: Examine
policies and procedures to verify that processes
are defined such that a significant change toorganizational structure results in documented
review of the impact to PCI DSS scope andapplicability of controls.

Customized Approach Objective
PCI DSS scope is confirmed after significant
organizational change.

Applicability Notes

12.5.3.b Additional testing procedure forservice provider assessments only: Examine
documentation (for example, meeting minutes) andinterview responsible personnel to verify thatsignificant changes to organizational structure
resulted in documented reviews that included allelements specified in this requirement, with results
communicated to executive management.

This requirement applies only when the entity being
assessed is a service provider.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeAn organization’s structure and management
define the requirements and protocol for effective
and secure operations. Changes to this structure
could have negative effects to existing controls
and frameworks by reallocating or removing
resources that once supported PCI DSS controls
or inheriting new responsibilities that may nothave established controls in place. Therefore, it isimportant to revisit PCI DSS scope and controls
when there are changes to an organization’s
structure and management to ensure controls arein place and active.
ExamplesChanges to organizational structure include, but
are not limited to, company mergers or
acquisitions, and significant changes orreassignments of personnel with responsibility forsecurity controls.

March 2022
Page 276Requirements and Testing Procedures

Guidance

12.6 Security awareness education is an ongoing activity.

Defined Approach Requirements

Defined Approach Testing Procedures

12.6.1 A formal security awareness program is
implemented to make all personnel aware of theentity’s information security policy and procedures,and their role in protecting the cardholder data.

12.6.1 Examine the security awareness program toverify it provides awareness to all personnel about
the entity’s information security policy andprocedures, and personnel’s role in protecting the
cardholder data.

PurposeIf personnel are not educated about theircompany’s information security policies andprocedures and their own security responsibilities,
security safeguards and processes that havebeen implemented may become ineffective
through unintentional errors or intentional actions.

Customized Approach Objective
Personnel are knowledgeable about the threat
landscape, their responsibility for the operation of
relevant security controls, and are able to accessassistance and guidance when required.

Defined Approach Requirements

Defined Approach Testing Procedures

12.6.2 The security awareness program is:

12.6.2 Examine security awareness programcontent, evidence of reviews, and interview
personnel to verify that the security awarenessprogram is in accordance with all elements
specified in this requirement.

•

Reviewed at least once every 12 months, and•Updated as needed to address any new threats
and vulnerabilities that may impact the securityof the entity’s CDE, or the information provided
to personnel about their role in protecting
cardholder data.

Purpose
The threat environment and an entity’s defenses
are not static. As such, the security awarenessprogram materials must be updated as frequently
as needed to ensure that the education received
by personnel is up to date and represents thecurrent threat environment.

Customized Approach Objective
The content of security awareness material isreviewed and updated periodically.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 277

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.6.3 Personnel receive security awarenesstraining as follows:

12.6.3.a Examine security awareness program
records to verify that personnel attend security
awareness training upon hire and at least once
every 12 months.

•

Upon hire and at least once every 12 months.

•

Multiple methods of communication are used.

•

Personnel acknowledge at least once every 12
months that they have read and understood theinformation security policy and procedures.

12.6.3.b Examine security awareness program
materials to verify the program includes multiple
methods of communicating awareness andeducating personnel.
12.6.3.c Interview personnel to verify they havecompleted awareness training and are aware of
their role in protecting cardholder data.

Customized Approach Objective
Personnel remain knowledgeable about the threat
landscape, their responsibility for the operation of
relevant security controls, and are able to accessassistance and guidance when required.

12.6.3.d Examine security awareness program
materials and personnel acknowledgments toverify that personnel acknowledge at least once
every 12 months that they have read andunderstand the information security policy andprocedures.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeTraining of personnel ensures they receive theinformation about the importance of information
security and that they understand their role inprotecting the organization.
Requiring an acknowledgment by personnel helps
ensure that they have read and understood the
security policies and procedures, and that they
have made and will continue to make acommitment to comply with these policies.
Good Practice
Entities may incorporate new-hire training as partof the Human Resources onboarding process.
Training should outline the security-related “dos”
and “don’ts.” Periodic refresher training reinforces
key security processes and procedures that may
be forgotten or bypassed.
Entities should consider requiring security
awareness training anytime personnel transfer
into roles where they can impact the security ofaccount data from roles where they did not havethis impact.
Methods and training content can vary, dependingon personnel roles.
ExamplesDifferent methods that can be used to provide
security awareness and education include
posters, letters, web-based training, in-person
training, team meetings, and incentives.
Personnel acknowledgments may be recorded inwriting or electronically.

March 2022
Page 278Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.6.3.1 Security awareness training includes
awareness of threats and vulnerabilities that could
impact the security of the CDE, including but notlimited to:

12.6.3.1 Examine security awareness training
content to verify it includes all elements specified inthis requirement.

•

Phishing and related attacks.

•

Social engineering.

Customized Approach Objective
Personnel are knowledgeable about their own
human vulnerabilities and how threat actors willattempt to exploit such vulnerabilities. Personnel areable to access assistance and guidance whenrequired.

Applicability Notes
See Requirement 5.4.1 for guidance on the
difference between technical and automatedcontrols to detect and protect users from phishingattacks, and this requirement for providing users
security awareness training about phishing andsocial engineering. These are two separate anddistinct requirements, and one is not met by
implementing controls required by the other one.
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Educating personnel on how to detect, react to,
and report potential phishing and related attacks
and social engineering attempts is essential tominimizing the probability of successful attacks.
Good PracticeAn effective security awareness program should
include examples of phishing emails and periodic
testing to determine the prevalence of personnel
reporting such attacks. Training material an entity
can consider for this topic include:•

How to identify phishing and other social
engineering attacks.

•

How to react to suspected phishing and social
engineering.

Where and how to report suspected phishingand social engineering activity.
An emphasis on reporting allows the organization
to reward positive behavior, to optimize technicaldefenses (see Requirement 5.4.1), and to take
immediate action to remove similar phishingemails that evaded technical defenses fromrecipient inboxes.

•

March 2022
Page 279

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.6.3.2 Security awareness training includes
awareness about the acceptable use of end-user
technologies in accordance with Requirement
12.2.1.

12.6.3.2 Examine security awareness training
content to verify it includes awareness about
acceptable use of end-user technologies inaccordance with Requirement 12.2.1.

Guidance
PurposeBy including the key points of the acceptable use
policy in regular training and the related context,
personnel will understand their responsibilities
and how these impact the security of anorganization’s systems.

Customized Approach Objective
Personnel are knowledgeable about their
responsibility for the security and operation of enduser technologies and are able to access assistanceand guidance when required.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 280

Requirements and Testing Procedures

Guidance

12.7 Personnel are screened to reduce risks from insider threats.

Defined Approach Requirements

Defined Approach Testing Procedures

12.7.1 Potential personnel who will have access to
the CDE are screened, within the constraints oflocal laws, prior to hire to minimize the risk ofattacks from internal sources.

12.7.1 Interview responsible Human Resource
department management to verify that screening is
conducted, within the constraints of local laws,
prior to hiring potential personnel who will haveaccess to the CDE.

Customized Approach Objective
The risk related to allowing new members of staff
access to the CDE is understood and managed.

Applicability Notes
For those potential personnel to be hired for
positions such as store cashiers, who only haveaccess to one card number at a time whenfacilitating a transaction, this requirement is arecommendation only.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Purpose
Performing thorough screening prior to hiring
potential personnel who are expected to be given
access to the CDE provides entities with theinformation necessary to make informed risk
decisions regarding personnel they hire that will
have access to the CDE.
Other benefits of screening potential personnel
include helping to ensure workplace safety andconfirming information provided by prospective
employees on their resumes.
Good Practice
Entities should consider screening for existing
personnel anytime they transfer into roles where
they have access to the CDE from roles where
they did not have this access.
To be effective, the level of screening should beappropriate for the position. For example,
positions requiring greater responsibility or thathave administrative access to critical data orsystems may warrant more detailed or more
frequent screening than positions with lessresponsibility and access.
ExamplesScreening options can include, as appropriate forthe entity’s region, previous employment history,
review of public information/social media
resources, criminal record, credit history, andreference checks.

March 2022
Page 281

Requirements and Testing Procedures

Guidance

12.8 Risk to information assets associated with third-party service provider (TPSP) relationships is managed.

Defined Approach Requirements

Defined Approach Testing Procedures

12.8.1 A list of all third-party service providers(TPSPs) with which account data is shared or that
could affect the security of account data ismaintained, including a description for each of theservices provided.

12.8.1.a Examine policies and procedures to verify
that processes are defined to maintain a list of
TPSPs, including a description for each of theservices provided, for all TPSPs with whomaccount data is shared or that could affect the
security of account data.

Customized Approach Objective

12.8.1.b Examine documentation to verify that alist of all TPSPs is maintained that includes a
description of the services provided.

Records are maintained of TPSPs and the services
provided.

PurposeMaintaining a list of all TPSPs identifies where
potential risk extends outside the organizationand defines the organization’s extended attack
surface.
ExamplesDifferent types of TPSPs include those that:••

Applicability Notes
The use of a PCI DSS compliant TPSP does notmake an entity PCI DSS compliant, nor does it
remove the entity’s responsibility for its own PCI
DSS compliance.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

•

Store, process, or transmit account data on
the entity’s behalf (such as payment
gateways, payment processors, payment
service providers (PSPs), and off-sitestorage providers).
Manage system components included in theentity’s PCI DSS assessment (such asproviders of network security control
services, anti-malware services, and security
incident and event management (SIEM);
contact and call centers; web-hosting
companies; and IaaS, PaaS, SaaS, andFaaS cloud providers).
Could impact the security of the entity’s CDE(such as vendors providing support via
remote access, and bespoke softwaredevelopers).

March 2022
Page 282

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.8.2 Written agreements with TPSPs aremaintained as follows:

12.8.2.a Examine policies and procedures to verify
that processes are defined to maintain writtenagreements with all TPSPs in accordance with allelements specified in this requirement.

•

Written agreements are maintained with all
TPSPs with which account data is shared or that
could affect the security of the CDE.

•

Written agreements include acknowledgmentsfrom TPSPs that they are responsible for the
security of account data the TPSPs possess orotherwise store, process, or transmit on behalf ofthe entity, or to the extent that they could impact
the security of the entity’s CDE.

12.8.2.b Examine written agreements with TPSPs
to verify they are maintained in accordance with allelements as specified in this requirement.

Customized Approach Objective
Records are maintained of each TPSP’s
acknowledgment of its responsibility to protect
account data.

Applicability Notes
The exact wording of an acknowledgment will
depend on the agreement between the two parties,
the details of the service being provided, and the
responsibilities assigned to each party. The
acknowledgment does not have to include the exact
wording provided in this requirement.
Evidence that a TPSP is meeting PCI DSS
requirements (for example, a PCI DSS Attestation ofCompliance (AOC) or a declaration on a company’s
website) is not the same as a written agreement
specified in this requirement.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeThe written acknowledgment from a TPSP
demonstrates its commitment to maintaining
proper security of account data that it obtains
from its customers and that the TPSP is fully
aware of the assets that could be affected during
the provisioning of the TPSP’s service. The extent
to which a specific TPSP is responsible for the
security of account data will depend on theservice provided and the agreement between theprovider and assessed entity (the customer).
In conjunction with Requirement 12.9.1, thisrequirement is intended to promote a consistentlevel of understanding between parties about theirapplicable PCI DSS responsibilities. For example,
the agreement may include the applicable PCI
DSS requirements to be maintained as part of theprovided service.
Good Practice
The entity may also want to consider including intheir written agreement with a TPSP that the
TPSP will support the entity’s request for
information per Requirement 12.9.2. Entities will
also want to understand whether any TPSPs have“nested” relationships with other TPSPs, meaning
the primary TPSP contracts with another TPSP(s)for the purposes of providing a service.
It is important to understand whether the primary
TPSP is relying on the secondary TPSP(s) toachieve overall compliance of a service, and whattypes of written agreements the primary TPSP
has in place with the secondary TPSPs. Entities
can consider including coverage in their writtenagreement for any “nested” TPSPs a primary
TPSP may use.
Further Information
Refer to the “Information Supplement: Third-Party
Security Assurance for further guidance.

March 2022
Page 283

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.8.3 An established process is implemented forengaging TPSPs, including proper due diligence
prior to engagement.

12.8.3.a Examine policies and procedures to verify
that processes are defined for engaging TPSPs,
including proper due diligence prior to
engagement.

Customized Approach Objective

12.8.3.b Examine evidence and interview
responsible personnel to verify the process forengaging TPSPs includes proper due diligence
prior to engagement.

The capability, intent, and resources of aprospective TPSP to adequately protect accountdata are assessed before the TPSP is engaged.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeA thorough process for engaging TPSPs,
including details for selection and vetting prior to
engagement, helps ensure that a TPSP is
thoroughly vetted internally by an entity prior toestablishing a formal relationship and that the risk
to cardholder data associated with theengagement of the TPSP is understood.
Good PracticeSpecific due-diligence processes and goals willvary for each organization. Elements that should
be considered include the provider’s reporting
practices, breach-notification and incident
response procedures, details of how PCI DSS
responsibilities are assigned between each party,
how the TPSP validates their PCI DSS
compliance and what evidence they provide.

March 2022
Page 284

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.8.4 A program is implemented to monitor TPSPs’PCI DSS compliance status at least once every 12
months.

12.8.4.a Examine policies and procedures to verify
that processes are defined to monitor TPSPs’ PCI
DSS compliance status at least once every 12
months.

Customized Approach Objective

12.8.4.b Examine documentation and interview
responsible personnel to verify that the PCI DSS
compliance status of each TPSP is monitored atleast once every 12 months.

The PCI DSS compliance status of TPSPs isverified periodically.

Applicability Notes
Where an entity has an agreement with a TPSP for
meeting PCI DSS requirements on behalf of theentity (for example, via a firewall service), the entity
must work with the TPSP to make sure theapplicable PCI DSS requirements are met. If the
TPSP does not meet those applicable PCI DSS
requirements, then those requirements are also “notin place” for the entity.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Knowing the PCI DSS compliance status of allengaged TPSPs provides assurance andawareness about whether they comply with therequirements applicable to the services they offerto the organization.
Good Practice
If the TPSP offers a variety of services, thecompliance status the entity monitors should bespecific to those services delivered to the entity
and those services in scope for the entity’s PCI
DSS assessment.
If a TPSP has a PCI DSS Attestation ofCompliance (AOC), the expectation is that the
TPSP should provide that to customers uponrequest to demonstrate their PCI DSS compliancestatus.
If the TPSP did not undergo a PCI DSS
assessment, it may be able to provide othersufficient evidence to demonstrate that it has met
the applicable requirements without undergoing aformal compliance validation. For example, the
TPSP can provide specific evidence to the entity’sassessor so the assessor can confirm applicablerequirements are met. Alternatively, the TPSP
can elect to undergo multiple on-demandassessments by each of its customers’ assessors,with each assessment targeted to confirm thatapplicable requirements are met.
Further Information
For more information about third-party service
providers, refer to:•

PCI DSS section: Use of Third-Party Service
Providers.

•Information Supplement: Third-Party Security
Assurance.

March 2022
Page 285

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.8.5 Information is maintained about which PCI
DSS requirements are managed by each TPSP,
which are managed by the entity, and any that areshared between the TPSP and the entity.

12.8.5.a Examine policies and procedures to verify
that processes are defined to maintain information
about which PCI DSS requirements are managed
by each TPSP, which are managed by the entity,
and any that are shared between both the TPSP
and the entity.

Customized Approach Objective
Records detailing the PCI DSS requirements andrelated system components for which each TPSP issolely or jointly responsible, are maintained andreviewed periodically.

12.8.5.b Examine documentation and interview
personnel to verify the entity maintains information
about which PCI DSS requirements are managed
by each TPSP, which are managed by the entity,
and any that are shared between both entities.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIt is important that the entity understands which
PCI DSS requirements and sub-requirements its
TPSPs have agreed to meet, which requirements
are shared between the TPSP and the entity, andfor those that are shared, specifics about how therequirements are shared and which entity is
responsible for meeting each sub-requirement.
Without this shared understanding, it is inevitablethat the entity and the TPSP will assume a given
PCI DSS sub-requirement is the responsibility ofthe other party, and therefore that subrequirement may not be addressed at all.
The specific information an entity maintains will
depend on the particular agreement with theirproviders, the type of service, etc. TPSPs may
define their PCI DSS responsibilities to be thesame for all their customers; otherwise, this
responsibility should be agreed upon by both theentity and TPSP.
Good Practice
Entities can document these responsibilities via amatrix that identifies all applicable PCI DSS
requirements and indicates for each requirement
whether the entity or TPSP is responsible formeeting that requirement or whether it is a shared
responsibility. This type of document is often
referred to as a responsibility matrix.
(continued on next page)

March 2022
Page 286Requirements and Testing Procedures

Guidance
It is also important for entities to understandwhether any TPSPs have “nested” relationships
with other TPSPs, meaning the primary TPSP
contracts with another TPSP(s) for the purposesof providing a service. It is important tounderstand whether the primary TPSP is relying
on the secondary TPSP(s) to achieve overall
compliance of a service, and how the primary
TPSP is monitoring performance of the service
and the PCI DSS compliance status of thesecondary TPSP(s). Note that it is the
responsibility of the primary TPSP to manage andmonitor any secondary TPSPs.
Further Information
Refer to Information Supplement: Third-Party
Security Assurance for a sample responsibility
matrix template.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 287

Requirements and Testing Procedures

Guidance

12.9 Third-party service providers (TPSPs) support their customers’ PCI DSS compliance.

Defined Approach Requirements

Defined Approach Testing Procedures

12.9.1 Additional requirement for service
providers only: TPSPs acknowledge in writing tocustomers that they are responsible for the securityof account data the TPSP possesses or otherwise
stores, processes, or transmits on behalf of thecustomer, or to the extent that they could impact the
security of the customer’s CDE.

12.9.1 Additional testing procedure for service
provider assessments only: Examine TPSP
policies, procedures, and templates used for
written agreements to verify processes are definedfor the TPSP to provide written acknowledgments
to customers in accordance with all elements
specified in this requirement.

Customized Approach Objective
TPSPs formally acknowledge their security
responsibilities to their customers.

PurposeIn conjunction with Requirement 12.8.2, thisrequirement is intended to promote a consistentlevel of understanding between TPSPs and theircustomers about their applicable PCI DSS
responsibilities. The acknowledgment of the
TPSPs evidences their commitment tomaintaining proper security of account data that it
obtains from its clients.
The method by which the TPSP provides written
acknowledgment should be agreed between theprovider and its customers.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.
The exact wording of an acknowledgment will
depend on the agreement between the two parties,
the details of the service being provided, and the
responsibilities assigned to each party. The
acknowledgment does not have to include the exact
wording provided in this requirement.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 288Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.9.2 Additional requirement for service
providers only: TPSPs support their customers’
requests for information to meet Requirements
12.8.4 and 12.8.5 by providing the following uponcustomer request:

12.9.2 Additional testing procedure for service
provider assessments only: Examine policies
and procedures to verify processes are defined for
the TPSPs to support customers’ request for
information to meet Requirements 12.8.4 and12.8.5 in accordance with all elements specified inthis requirement.

•

PCI DSS compliance status information for any
service the TPSP performs on behalf ofcustomers (Requirement 12.8.4).

•

Information about which PCI DSS requirements
are the responsibility of the TPSP and which are
the responsibility of the customer, including any
shared responsibilities (Requirement 12.8.5).

Customized Approach Objective
TPSPs provide information as needed to support
their customers’ PCI DSS compliance efforts.

Applicability Notes
This requirement applies only when the entity being
assessed is a service provider.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIf a TPSP does not provide the necessary
information to enable its customers to meet theirsecurity and compliance requirements, thecustomers will not be able to protect cardholder
data nor meet their own contractual obligations.
Good Practice
If a TPSP has a PCI DSS Attestation ofCompliance (AOC), the expectation is that the
TPSP should provide that to customers uponrequest to demonstrate their PCI DSS compliancestatus.
If the TPSP did not undergo a PCI DSS
assessment, they may be able to provide othersufficient evidence to demonstrate that it has met
the applicable requirements without undergoing aformal compliance validation. For example, the
TPSP can provide specific evidence to the entity’sassessor so the assessor can confirm applicablerequirements are met. Alternatively, the TPSP
can elect to undergo multiple on-demandassessments by each of its customers’ assessors,with each assessment targeted to confirm thatapplicable requirements are met.
TPSPs should provide sufficient evidence to theircustomers to verify that the scope of the TPSP’s
PCI DSS assessment covered the services
applicable to the customer and that the relevant
PCI DSS requirements were examined anddetermined to be in place.
(continued on next page)

March 2022
Page 289

Requirements and Testing Procedures

Guidance
TPSPs may define their PCI DSS responsibilities
to be the same for all their customers; otherwise,
this responsibility should be agreed upon by boththe customer and TPSP. It is important that thecustomer understands which PCI DSS
requirements and sub-requirements its TPSPs
have agreed to meet, which requirements areshared between the TPSP and the customer, andfor those that are shared, specifics about how therequirements are shared and which entity is
responsible for meeting each sub-requirement. An
example of a way to document these
responsibilities is via a matrix that identifies all
applicable PCI DSS requirements and indicates
whether the customer or TPSP is responsible formeeting that requirement or whether it is a shared
responsibility.
Further Information
For further guidance, refer to:

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

•

PCI DSS section: Use of Third-Party Service
Providers.

•Information Supplement: Third-Party Security
Assurance (includes a sample responsibility
matrix template).

March 2022
Page 290

Requirements and Testing Procedures

Guidance

12.10 Suspected and confirmed security incidents that could impact the CDE are responded to immediately.

Defined Approach Requirements

Defined Approach Testing Procedures

12.10.1 An incident response plan exists and isready to be activated in the event of a suspected orconfirmed security incident. The plan includes, but is
not limited to:12.10.1.a Examine the incident response plan toverify that the plan exists and includes at least theelements specified in this requirement.

•

Roles, responsibilities, and communication andcontact strategies in the event of a suspected orconfirmed security incident, including notificationof payment brands and acquirers, at a minimum.

•

Incident response procedures with specificcontainment and mitigation activities for different
types of incidents.

•

Business recovery and continuity procedures.

•

Data backup processes.

•

Analysis of legal requirements for reporting
compromises.

•

Coverage and responses of all critical systemcomponents.

•

Reference or inclusion of incident response
procedures from the payment brands.

12.10.1.b Interview personnel and examine
documentation from previously reported incidents
or alerts to verify that the documented incident
response plan and procedures were followed.

Customized Approach Objective
A comprehensive incident response plan that meetscard brand expectations is maintained.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeWithout a comprehensive incident response planthat is properly disseminated, read, andunderstood by the parties responsible, confusion
and lack of a unified response could create further
downtime for the business, unnecessary public
media exposure, as well as risk of financial and/or
reputational loss and legal liabilities.
Good Practice
The incident response plan should be thoroughand contain all the key elements for stakeholders(for example, legal, communications) to allow theentity to respond effectively in the event of abreach that could impact account data. It is
important to keep the plan up to date with current
contact information of all individuals designatedas having a role in incident response. Other
relevant parties for notifications may include
customers, financial institutions (acquirers andissuers), and business partners.
Entities should consider how to address allcompromises of data within the CDE in theirincident response plans, including to accountdata, wireless encryption keys, encryption keys
used for transmission and storage or accountdata or cardholder data, etc.
ExamplesLegal requirements for reporting compromises
include those in most US states, the EU General
Data Protection Regulation (GDPR), and the
Personal Data Protection Act (Singapore).
Further Information
For more information, refer to the NIST SP 80061 Rev. 2, Computer Security Incident Handling
Guide.

March 2022
Page 291

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.10.2 At least once every 12 months, the security
incident response plan is:

12.10.2 Interview personnel and review
documentation to verify that, at least once every 12
months, the security incident response plan is:•

Reviewed and the content is updated as needed.

•

Tested, including all elements listed in
Requirement 12.10.1.

•

Reviewed and updated as needed.

•

Tested, including all elements listed in
Requirement 12.10.1.

Customized Approach Objective
The incident response plan is kept current andtested periodically.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeProper testing of the security incident response
plan can identify broken business processes andensure key steps are not missed, which could
result in increased exposure during an incident.
Periodic testing of the plan ensures that theprocesses remain viable, as well as ensuring that
all relevant personnel in the organization arefamiliar with the plan.
Good Practice
The test of the incident response plan can include
simulated incidents and the corresponding
responses in the form of a “table-top exercise”,
that include participation by relevant personnel. A
review of the incident and the quality of the
response can provide entities with the assurance
that all required elements are included in the plan.

March 2022
Page 292

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.10.3 Specific personnel are designated to beavailable on a 24/7 basis to respond to suspected orconfirmed security incidents.

12.10.3 Examine documentation and interview
responsible personnel occupying designated roles
to verify that specific personnel are designated to
be available on a 24/7 basis to respond to security
incidents.

Customized Approach Objective
Incidents are responded to immediately whereappropriate.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeAn incident could occur at any time, therefore if aperson who is trained in incident response andfamiliar with the entity’s plan is available when an
incident is detected, the entity’s ability to correctly
respond to the incident is increased.
Good PracticeOften, specific personnel are designated to bepart of a security incident response team, with theteam having overall responsibility for responding
to incidents (perhaps on a rotating schedulebasis) and managing those incidents inaccordance with the plan. The incident response
team can consist of core members who arepermanently assigned or “on-demand” personnel
who may be called up as necessary, dependingon their expertise and the specifics of the incident.
Having available resources to respond quickly toincidents minimizes disruption to the organization.
Examples of types of activity the team orindividuals should respond to include any
evidence of unauthorized activity, detection ofunauthorized wireless access points, critical IDS
alerts, and reports of unauthorized critical systemor content file changes.

March 2022
Page 293

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.10.4 Personnel responsible for responding tosuspected and confirmed security incidents areappropriately and periodically trained on theirincident response responsibilities.

12.10.4 Examine training documentation andinterview incident response personnel to verify that
personnel are appropriately and periodicallytrained on their incident response responsibilities.

Customized Approach Objective
Personnel are knowledgeable about their role andresponsibilities in incident response and are able toaccess assistance and guidance when required.

Defined Approach Requirements

Defined Approach Testing Procedures

12.10.4.1 The frequency of periodic training forincident response personnel is defined in theentity’s targeted risk analysis, which is performed
according to all elements specified in Requirement
12.3.1.

12.10.4.1.a Examine the entity’s targeted risk
analysis for the frequency of training for incident
response personnel to verify the risk analysis was
performed in accordance with all elements
specified in Requirement 12.3.1.

Customized Approach Objective

12.10.4.1.b Examine documented results ofperiodic training of incident response personnel
and interview personnel to verify training is
performed at the frequency defined in the entity’s
targeted risk analysis performed for thisrequirement.

Incident response personnel are trained at afrequency that addresses the entity’s risk.

Guidance
PurposeWithout a trained and readily available incident
response team, extended damage to the network
could occur, and critical data and systems may
become “polluted” by inappropriate handling of
the targeted systems. This can hinder the
success of a post-incident investigation.
Good Practice
It is important that all personnel involved inincident response are trained and knowledgeable
about managing evidence for forensics andinvestigations.
PurposeEach entity’s environment and incident response
plan are different and the approach will depend
on a number of factors, including the size andcomplexity of the entity, the degree of change inthe environment, the size of the incident response
team, and the turnover in personnel.
Performing a risk analysis will allow the entity todetermine the optimum frequency for training
personnel with incident response responsibilities.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 294

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.10.5 The security incident response plan
includes monitoring and responding to alerts fromsecurity monitoring systems, including but notlimited to:12.10.5 Examine documentation and observeincident response processes to verify thatmonitoring and responding to alerts from security
monitoring systems are covered in the security
incident response plan, including but not limited tothe systems specified in this requirement.

•

Intrusion-detection and intrusion-prevention
systems.

•

Network security controls.

•

Change-detection mechanisms for critical files.

•

The change-and tamper-detection mechanism
for payment pages. This bullet is a best practice
until its effective date; refer to Applicability Notes
below for details.

•

Detection of unauthorized wireless accesspoints.

Guidance
PurposeResponding to alerts generated by security
monitoring systems that are explicitly designed tofocus on potential risk to data is critical to preventa breach and therefore, this must be included in
the incident-response processes.

Customized Approach Objective
Alerts generated by monitoring and detection
technologies are responded to in a structured,
repeatable manner.

Applicability Notes
The bullet above (for monitoring and responding toalerts from a change- and tamper-detection
mechanism for payment pages) is a best practice
until 31 March 2025, after which it will be required
as part of Requirement 12.10.5 and must be fully
considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 295

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.10.6 The security incident response plan ismodified and evolved according to lessons learned
and to incorporate industry developments.

12.10.6.a Examine policies and procedures toverify that processes are defined to modify andevolve the security incident response plan
according to lessons learned and to incorporate
industry developments.

Customized Approach Objective
The effectiveness and accuracy of the incident
response plan is reviewed and updated after each
invocation.

12.10.6.b Examine the security incident response
plan and interview responsible personnel to verify
that the incident response plan is modified andevolved according to lessons learned and toincorporate industry developments.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
Purpose
Incorporating lessons learned into the incident
response plan after an incident occurs and in-stepwith industry developments, helps keep the plancurrent and able to react to emerging threats andsecurity trends.
Good Practice
The lessons-learned exercise should include alllevels of personnel. Although it is often included
as part of the review of the entire incident, it
should focus on how the entity’s response to theincident could be improved.
It is important to not just consider elements of the
response that did not have the planned outcomesbut also to understand what worked well andwhether lessons from those elements that worked
well can be applied areas of the plan that didn’t.
Another way to optimize an entity’s incident
response plan is to understand the attacks madeagainst other organizations and use that
information to fine-tune the entity’s detection,
containment, mitigation, or recovery procedures.

March 2022
Page 296Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing Procedures

12.10.7 Incident response procedures are in place,
to be initiated upon the detection of stored PAN
anywhere it is not expected, and include:

12.10.7.a Examine documented incident response
procedures to verify that procedures for responding
to the detection of stored PAN anywhere it is notexpected to exist, ready to be initiated, and include
all elements specified in this requirement.

•

Determining what to do if PAN is discovered
outside the CDE, including its retrieval, securedeletion, and/or migration into the currently
defined CDE, as applicable.

•

Identifying whether sensitive authentication datais stored with PAN.

•

Determining where the account data came fromand how it ended up where it was not expected.

•

Remediating data leaks or process gaps that
resulted in the account data being where it was
not expected.

12.10.7.b Interview personnel and examine
records of response actions to verify that incident
response procedures are performed upondetection of stored PAN anywhere it is notexpected.

Customized Approach Objective
Processes are in place to quickly respond, analyze,
and address situations in the event that cleartext
PAN is detected where it is not expected.

Guidance
PurposeHaving documented incident response
procedures that are followed in the event that
stored PAN is found anywhere it is not expected
to be, helps to identify the necessary remediation
actions and prevent future leaks.
Good Practice
If PAN was found outside the CDE, analysis
should be performed to 1) determine whether it
was saved independently of other data or withsensitive authentication data, 2) identify thesource of the data, and 3) identify the control
gaps that resulted in the data being outside theCDE.
Entities should consider whether there arecontributory factors, such as business processes,
user behavior, improper system configurations,etc. that caused the PAN to be stored in an
unexpected location. If such contributory factors
are present, they should be addressed per thisRequirement to prevent recurrence.

Applicability Notes
This requirement is a best practice until 31 March
2025, after which it will be required and must be
fully considered during a PCI DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 297

Appendix A

Additional PCI DSS Requirements

This appendix contains additional PCI DSS requirements for different types of entities. The sections within this Appendix include:Appendix A1: Additional PCI DSS Requirements for Multi-Tenant Service Providers

Appendix A2: Additional PCI DSS Requirements for Entities Using SSL/early TLS for Card-Present POS POI Terminal Connections

Appendix A3: Designated Entities Supplemental Validation (DESV)

Guidance and applicability information is provided in each section.

Appendix A1: Additional PCI DSS Requirements for Multi-Tenant Service Providers
Sections
A1.1 Multi-tenant service providers protect and separate all customer environments and data.
A1.2 Multi-tenant service providers facilitate logging and incident response for all customers.
Overview
All service providers are responsible for meeting PCI DSS requirements for their own environments as applicable to the services offered to their customers. In
addition, multi-tenant service providers must meet the requirements in this Appendix.
Multi-tenant service providers are a type of third-party service provider that offers various shared services to merchants and other service providers, where
customers share system resources (such as physical or virtual servers), infrastructure, applications (including Software as a Service (SaaS)), and/or databases.
Services may include, but are not limited to, hosting multiple entities on a single shared server, providing e-commerce and/or “shopping cart” services, webbased hosting services, payment applications, various cloud applications and services, and connections to payment gateways and processors.
Service providers that provide only shared data center services (often called co-location or “co-lo” providers), where equipment, space, and bandwidth areavailable on a rental basis, are not considered multi-tenant service providers for purposes of this Appendix.
Note: Even though a multi-tenant service provider may meet these requirements, each customer is still responsible to comply with the PCI DSS requirementsthat are applicable to its environment and validate compliance as applicable. Often, there are PCI DSS requirements for which responsibility is shared between
the provider and the customer (for perhaps different aspects of the environment). Requirements 12.8 and 12.9 delineate requirements specific to therelationships between all third-party service providers (TPSPs) and their customers, and the responsibilities of both. This includes defining the specific services
the customer is receiving, along with which PCI DSS requirements are the responsibility of the customer to meet, which are the responsibility of the TPSP, andwhich requirements are shared between both customer and the TPSP.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 298Requirements and Testing Procedures

Guidance

A1.1 Multi-tenant service providers protect and separate all customer environments and data.

Defined Approach Requirements

Defined Approach Testing ProceduresA1.1.1 Logical separation is implemented asfollows:

A1.1.1 Examine documentation and system andnetwork configurations and interview personnel toverify that logical separation is implemented inaccordance with all elements specified in thisrequirement.

•

The provider cannot access its customers’
environments without authorization.

•

Customers cannot access the provider’senvironment without authorization.

Customized Approach Objective
Customers cannot access the provider’senvironment. The provider cannot access its
customers’ environments without authorization.

Applicability Notes
This requirement is a best practice until 31
March 2025, after which it will be required andmust be fully considered during a PCI DSS
assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeWithout controls between the provider’s environment
and the customer’s environment, a malicious actor
within the provider’s environment could compromise
the customer’s environment, and similarly, a
malicious actor in a customer environment could
compromise the provider and potentially other of theprovider’s customers.
Multi-tenant environments should be isolated fromeach other and from the provider’s infrastructuresuch that they can be separately managed entities
with no connectivity between them.
Good Practice
Providers should ensure strong separation between
the environments that are designed for customer
access, for example, configuration and billing portals,
and the provider’s private environment that should
only be accessed by authorized provider personnel.
Service provider access to customer environments is
performed in accordance with requirement 8.2.3.
Further Information
Refer to the Information Supplement: PCI SSC Cloud
Computing Guidelines for further guidance on cloudenvironments.

March 2022
Page 299

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA1.1.2 Controls are implemented such that eachcustomer only has permission to access its own
cardholder data and CDE.

A1.1.2.a Examine documentation to verify controls
are defined such that each customer only has
permission to access its own cardholder data andCDE.

Customized Approach Objective

A1.1.2.b Examine system configurations to verify
that customers have privileges established to only
access their own account data and CDE.

Customers cannot access other customers’
environments.

Defined Approach Requirements

Defined Approach Testing ProceduresA1.1.3 Controls are implemented such that eachcustomer can only access resources allocated tothem.

A1.1.3 Examine customer privileges to verify eachcustomer can only access resources allocated tothem.

Guidance
PurposeIt is important that a multi-tenant service provider
define controls so that each customer can only
access their own environment and CDE to prevent
unauthorized access from one customer’s
environment to another.
ExamplesIn a cloud-based infrastructure, such as an
infrastructure as a service (IaaS) offering, thecustomers’ CDE may include virtual network devices
and virtual servers that are configured and managed
by the customers, including operating systems, files,
memory, etc.
PurposeTo prevent any inadvertent or intentional impact toother customers’ environments or account data, it isimportant that each customer can access only
resources allocated to that customer.

Customized Approach Objective
Customers cannot impact resources allocated toother customers.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 300

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA1.1.4 The effectiveness of logical separation
controls used to separate customer
environments is confirmed at least once every
six months via penetration testing.

A1.1.4 Examine the results from the most recent
penetration test to verify that testing confirmed theeffectiveness of logical separation controls used toseparate customer environments.

Customized Approach Objective
Segmentation of customer environments fromother environments is periodically validated to beeffective.

Applicability Notes
The testing of adequate separation between
customers in a multi-tenant service provider
environment is in addition to the penetration
tests specified in Requirement 11.4.6.
This requirement is a best practice until 31
March 2025, after which it will be required andmust be fully considered during a PCI DSS
assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeMulti-tenant services providers are responsible formanaging the segmentation between theircustomers.
Without technical assurance that segmentation
controls are effective, it is possible that changes tothe service provider’s technology would inadvertently
create a vulnerability that could be exploited acrossall the service provider’s customers.
Good Practice
Effectiveness of separation techniques can be
confirmed by using service-provider-createdtemporary (mock-up) environments that represent
customer environments and attempting to 1) access
one temporary environment from anotherenvironment, and 2) access a temporary environment
from the Internet.

March 2022
Page 301

Requirements and Testing Procedures

Guidance

A1.2 Multi-tenant service providers facilitate logging and incident response for all customers.

Defined Approach Requirements

Defined Approach Testing ProceduresA1.2.1 Audit log capability is enabled for eachcustomer’s environment that is consistent withPCI DSS Requirement 10, including:A1.2.1 Examine documentation and system
configuration settings to verify the provider has
enabled audit log capability for each customer
environment in accordance with all elements
specified in this requirement.

•

Logs are enabled for common third-party
applications.

•

Logs are active by default.

•

Logs are available for review only by theowning customer.

•

Log locations are clearly communicated tothe owning customer.

•

Log data and availability is consistent withPCI DSS Requirement 10.

PurposeLog information is useful for detecting andtroubleshooting security incidents and is invaluable
for forensic investigations. Customers therefore needto have access to these logs.
However, log information can also be used by anattacker for reconnaissance, and so a customer’s log
information must only be accessible by the customerthat the log relates to.

Customized Approach Objective
Log capability is available to all customers
without affecting the confidentiality of othercustomers.

Defined Approach Requirements

Defined Approach Testing ProceduresA1.2.2 Processes or mechanisms are
implemented to support and/or facilitate prompt
forensic investigations in the event of asuspected or confirmed security incident for any
customer.

A1.2.2 Examine documented procedures to verify
that the provider has processes or mechanisms to
support and/or facilitate a prompt forensic
investigation of related servers in the event of asuspected or confirmed security incident for any
customer.

Customized Approach Objective
Forensic investigation is readily available to all
customers in the event of a suspected orconfirmed security incident.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeIn the event of a suspected or confirmed breach ofconfidentiality of cardholder data, a customer’s
forensic investigator aims to find the cause of thebreach, exclude the attacker from the environment,
and ensure all unauthorized access is removed.
Prompt and efficient responses to forensic
investigators’ requests can significantly reduce thetime taken for the investigator to secure thecustomer’s environment.

March 2022
Page 302

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA1.2.3 Processes or mechanisms are
implemented for reporting and addressing
suspected or confirmed security incidents andvulnerabilities, including:A1.2.3 Examine documented procedures andinterview personnel to verify that the provider has amechanism for reporting and addressing
suspected or confirmed security incidents andvulnerabilities, in accordance with all elements
specified in this requirement.

•

Customers can securely report security
incidents and vulnerabilities to the provider.

•

The provider addresses and remediates
suspected or confirmed security incidents
and vulnerabilities according to Requirement
6.3.1.

Customized Approach Objective
Suspected or confirmed security incidents orvulnerabilities are discovered and addressed.
Customers are informed where appropriate.

Guidance
PurposeSecurity vulnerabilities in the provided services canimpact the security of all the service provider’scustomers and therefore must be managed inaccordance with the service provider’s establishedprocesses, with priority given to resolving
vulnerabilities that have the highest probability ofcompromise.
Customers are likely to notice vulnerabilities andsecurity misconfigurations while using the service.
Implementing secure methods for customers toreport security incidents and vulnerabilities
encourages customers to report potential issues andenable the provider to quickly learn about andaddress potential issues within their environment.

Applicability Notes
This requirement is a best practice until 31
March 2025, after which it will be required andmust be fully considered during a PCI DSS
assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 303

Appendix A2: Additional PCI DSS Requirements for Entities Using SSL/Early TLS for CardPresent POS POI Terminal Connections
Sections
A2.1 POI terminals using SSL and/or early TLS are confirmed as not susceptible to known SSL/TLS exploits.

Overview
This Appendix applies only to entities using SSL/early TLS as a security control to protect POS POI terminals, including service providers thatprovide connections into POS POI terminals.
Entities using SSL and early TLS for POS POI terminal connections must work toward upgrading to a strong cryptographic protocol as soon as
possible. Additionally, SSL and/or early TLS must not be introduced into environments where those protocols don’t already exist. At the time of
publication, the known vulnerabilities are difficult to exploit in POS POI payment terminals. However, new vulnerabilities could emerge at any
time, and it is up to the organization to remain up to date with vulnerability trends and determine whether it is susceptible to any known exploits.
The PCI DSS requirements directly affected are:• Requirement 2.2.5: Where any insecure services, protocols, or daemons are present; business justification is documented, and additional
security features are documented and implemented that reduce the risk of using insecure services, protocols, or daemons.
• Requirement 2.2.7: All non-console administrative access is encrypted using strong cryptography.
• Requirement 4.2.1: Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public
networks.
SSL and early TLS must not be used as a security control to meet these requirements, except in the case of POS POI terminal connections, asdetailed in this appendix. To support entities working to migrate from SSL/early TLS on POS POI terminals, the following provisions areincluded:• New POS POI terminal implementations must not use SSL or early TLS as a security control.
• All POS POI terminal service providers must provide a secure service offering.
• Service providers supporting existing POS POI terminal implementations that use SSL and/or early TLS must have a formal Risk Mitigationand Migration Plan in place.
• POS POI terminals in card-present environments that can be verified as not being susceptible to any known exploits for SSL and early TLS,
and the SSL/TLS termination points to which they connect, may continue using SSL/early TLS as a security control.
Requirements in this Appendix are not eligible for the Customized Approach.
Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 304

Requirements and Testing Procedures

Guidance

A2.1 POI terminals using SSL and/or early TLS are confirmed as not susceptible to known SSL/TLS exploits.

Defined Approach Requirements

Defined Approach Testing ProceduresA2.1.1 Where POS POI terminals at the merchantor payment acceptance location use SSL and/or
early TLS, the entity confirms the devices are notsusceptible to any known exploits for those
protocols.

A2.1.1 For POS POI terminals using SSL and/or
early TLS, confirm the entity has documentation (forexample, vendor documentation, system/network
configuration details) that verifies the devices are notsusceptible to any known exploits for SSL/early TLS.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Applicability Notes
This requirement is intended to apply to the entitywith the POS POI terminal, such as a merchant.
This requirement is not intended for service
providers who serve as the termination orconnection point to those POS POI terminals.
Requirements A2.1.2 and A2.1.3 apply to POS
POI service providers.
The allowance for POS POI terminals that are notcurrently susceptible to exploits is based on
currently known risks. If new exploits are
introduced to which POS POI terminals are
susceptible, the POS POI terminals will need to be
updated immediately.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposePOS POI terminals used in card-present
environments can continue using SSL/early TLS
when it can be shown that the POS POI terminal
is not susceptible to the currently known exploits.
Good Practice
However, SSL is outdated technology and could
be susceptible to additional security vulnerabilities
in the future; it is therefore strongly recommended
that POS POI terminals be upgraded to a secure
protocol as soon as possible. If SSL/early TLS is
not needed in the environment, use of, andfallback to these versions should be disabled.
Further Information
Refer to the current PCI SSC Information
Supplements on SSL/Early TLS for further
guidance.

March 2022
Page 305

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA2.1.2 Additional requirement for service
providers only: All service providers with existing
connection points to POS POI terminals that use
SSL and/or early TLS as defined in A2.1 have aformal Risk Mitigation and Migration Plan in placethat includes:

A2.1.2 Additional testing procedure for service
provider assessments only: Review the
documented Risk Mitigation and Migration Plan toverify it includes all elements specified in thisrequirement.

•

Description of usage, including what data is
being transmitted, types and number ofsystems that use and/or support SSL/early
TLS, and type of environment.

•

Risk-assessment results and risk-reduction
controls in place.

•

Description of processes to monitor for new
vulnerabilities associated with SSL/early TLS.

•

Description of change control processes thatare implemented to ensure SSL/early TLS is
not implemented into new environments.

•

Overview of migration project plan to replace
SSL/early TLS at a future date.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Guidance
PurposePOS POI termination points, including but notlimited to service providers such as acquirers or
acquirer processors, can continue using SSL/early
TLS when it can be shown that the service
provider has controls in place that mitigate the riskof supporting those connections for the service
provider environment.
Good Practice
Service providers should communicate to all
customers using SSL/early TLS about the risks
associated with its use and the need to migrate toa secure protocol.
Definitions
The Risk Mitigation and Migration Plan is adocument prepared by the entity that details its
plans for migrating to a secure protocol anddescribes controls the entity has in place toreduce the risk associated with SSL/early TLS
until the migration is complete.
Further Information
Refer to the current PCI SSC Information
Supplements on SSL/early TLS for further
guidance on Risk Mitigation and Migration Plans.

Applicability Notes
This requirement applies only when the entity
being assessed is a service provider.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 306

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA2.1.3 Additional requirement for service
providers only: All service providers provide asecure service offering.

A2.1.3 Additional testing procedure for service
provider assessments only: Examine system
configurations and supporting documentation to
verify the service provider offers a secure protocol
option for its service.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Applicability Notes
This requirement applies only when the entity
being assessed is a service provider.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeCustomers must be able to choose to upgrade
their POIs to eliminate the vulnerability in using
SSL and early TLS. In many cases, customers willneed to take a phased or gradual approach tomigrate their POS POI estate from the insecure
protocol to a secure protocol and so will require
the service provider to support a secure offering.
Further Information
Refer to the current PCI SSC Information
Supplements on SSL/Early TLS for further
guidance.

March 2022
Page 307

Appendix A3: Designated Entities Supplemental Validation (DESV)
Sections
A3.1
A3.2
A3.3
A3.4
A3.5

A PCI DSS compliance program is implemented.
PCI DSS scope is documented and validated.
PCI DSS is incorporated into business-as-usual (BAU) activities.
Logical access to the cardholder data environment is controlled and managed.
Suspicious events are identified and responded to.
Overview

This Appendix applies only to entities designated by a payment brand(s) or acquirer as requiring additional validation of existing PCI DSS
requirements. An entity is required to undergo an assessment according to this Appendix ONLY if instructed to do so by an acquirer or apayment brand. Examples of entities that this Appendix could apply to include:• Those storing, processing, and/or transmitting large volumes of account data,• Those providing aggregation points for account data, or• Those that have suffered significant or repeated breaches of account data.
Additionally, other PCI standards may reference completion of this Appendix.
These supplemental validation steps are intended to provide greater assurance that PCI DSS controls are maintained effectively and on acontinuous basis through validation of business-as-usual (BAU) processes and increased validation and scoping consideration.
Note: Some requirements have defined timeframes (for example, at least once every three months or at least once every six months) within
which certain activities are to be performed. For initial assessment to this document, it is not required that an activity has been performed forevery such timeframe during the previous year, if the assessor verifies:• The activity was performed in accordance with the applicable requirement within the most recent timeframe (for example, the most recent
three-month or six-month period), and• The entity has documented policies and procedures for continuing to perform the activity within the defined timeframe.
For subsequent years after the initial assessment, an activity must have been performed within each required timeframe (for example, anactivity required every three months must have been performed at least four times during the previous year at an interval that does not exceed
90 days).
Not all requirements in PCI DSS apply to all entities that may undergo a PCI DSS assessment. It is for this reason that some PCI DSS
Requirements are duplicated in this appendix. Any questions about this appendix should be addressed to acquirers or payment brands.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 308Requirements and Testing Procedures

Guidance

A3.1 A PCI DSS compliance program is implemented.

Defined Approach Requirements

Defined Approach Testing ProceduresA3.1.1 Responsibility is established by executive
management for the protection of account data anda PCI DSS compliance program that includes:

A3.1.1.a Examine documentation to verify
executive management has assigned overall
accountability for maintaining the entity’s PCI DSS
compliance.

•

Overall accountability for maintaining PCI DSS
compliance.

•

Defining a charter for a PCI DSS complianceprogram.

Providing updates to executive management andboard of directors on PCI DSS complianceinitiatives and issues, including remediation
activities, at least once every 12 months.
PCI DSS Reference: Requirement 12•

A3.1.1.b Examine the company’s PCI DSS charterto verify it outlines the conditions under which the
PCI DSS compliance program is organized.
A3.1.1.c Examine executive management andboard of directors meeting minutes and/or
presentations to ensure PCI DSS complianceinitiatives and remediation activities arecommunicated at least once every 12 months.

Customized Approach Objective

Purpose
Executive management assignment of PCI DSS
compliance responsibilities ensures executivelevel visibility into the PCI DSS complianceprogram and allows for the opportunity to ask
appropriate questions to determine theeffectiveness of the program and influencestrategic priorities.
Good Practice
Executive management may include C-level
positions, board of directors, or equivalent. The
specific titles will depend on the particularorganizational structure.
Responsibility for the PCI DSS complianceprogram may be assigned to individual roles
and/or to business units within the organization.

This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 309

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.1.2 A formal PCI DSS compliance program is inplace that includes:

A3.1.2.a Examine information security policies andprocedures to verify that processes are defined for
a formal PCI DSS compliance program that
includes all elements specified in this requirement.

•

Definition of activities for maintaining andmonitoring overall PCI DSS compliance,
including business-as-usual activities.

•

Annual PCI DSS assessment processes.

•

Processes for the continuous validation of PCI
DSS requirements (for example, daily, weekly,
every three months, as applicable per therequirement).

A3.1.2.b Interview personnel and observecompliance activities to verify that a formal PCI
DSS compliance program is implemented inaccordance with all elements specified in thisrequirement.

A process for performing business-impact
analysis to determine potential PCI DSS impacts
for strategic business decisions.
PCI DSS Reference: Requirements 1-12•

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeA formal compliance program allows anorganization to monitor the health of its security
controls, be proactive if a control fails, andeffectively communicate activities and compliancestatus throughout the organization.
Good Practice
The PCI DSS compliance program can be a
dedicated program or part of overarchingcompliance and/or governance program, andshould include a well-defined methodology that
demonstrates consistent and effective evaluation.
Strategic business decisions that should beanalyzed for potential PCI DSS impacts may
include mergers and acquisitions, new technology
purchases, or new payment-acceptancechannels.
Definitions
Maintaining and monitoring an organization’s
overall PCI DSS compliance includes identifying
activities to be performed daily, weekly, monthly,
every three months, or annually, and ensuring
these activities are being performed accordingly(for example, using a security self-assessment or
PDCA methodology).
ExamplesMethodologies that support the management ofcompliance programs include Plan-Do-Check-Act(PDCA), ISO 27001, COBIT, DMAIC, and Six
Sigma.

March 2022
Page 310

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.1.3 PCI DSS compliance roles andresponsibilities are specifically defined and formallyassigned to one or more personnel, including:A3.1.3.a Examine information security policies andprocedures and interview personnel to verify that
PCI DSS compliance roles and responsibilities are
specifically defined and formally assigned to one ormore personnel in accordance with all elements ofthis requirement.

•

Managing PCI DSS business-as-usual activities.

•

Managing annual PCI DSS assessments.

•

Managing continuous validation of PCI DSS
requirements (for example, daily, weekly, every
three months, as applicable per therequirement).

A3.1.3.b Interview responsible personnel andverify they are familiar with and performing theirdesignated PCI DSS compliance responsibilities.

Managing business-impact analysis to determine
potential PCI DSS impacts for strategic businessdecisions.
PCI DSS Reference: Requirement 12•

Guidance
PurposeThe formal definition of specific PCI DSS
compliance roles and responsibilities helps toensure accountability and monitoring of ongoing
PCI DSS compliance efforts.
Good Practice
Ownership should be assigned to individuals withthe authority to make risk-based decisions, andupon whom accountability rests for the specificfunction. Duties should be formally defined, andowners should be able to demonstrate anunderstanding of their responsibilities andaccountability.
Compliance roles may be assigned to a single
owner or multiple owners for different requirement
elements.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 311

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.1.4 Up-to-date PCI DSS and/or information
security training is provided at least once every 12
months to personnel with PCI DSS complianceresponsibilities (as identified in A3.1.3).
PCI DSS Reference: Requirement 12

A3.1.4.a Examine information security policies andprocedures to verify that PCI DSS and/or
information security training is required at least
once every 12 months for each role with PCI DSS
compliance responsibilities.

Customized Approach Objective

A3.1.4.b Interview personnel and examine
certificates of attendance or other records to verify
that personnel with PCI DSS complianceresponsibility receive up-to-date PCI DSS and/or
similar information security training at least once
every 12 months.

This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposePersonnel responsible for PCI DSS compliance
have specific training needs exceeding that which
is typically provided by general security
awareness training to enable them to performtheir role.
Good Practice
Individuals with PCI DSS complianceresponsibilities should receive specialized training
that, in addition to a general awareness of
information security, focuses on specific security
topics, skills, processes, or methodologies thatmust be followed for those individuals to performtheir compliance responsibilities effectively.
Training may be offered by third parties such as
the PCI SSC (for example, PCI Awareness, PCIP,
and ISA), payment brands, and acquirers, ortraining may be internal. Training content should
be applicable for the individual’s job function, becurrent, and include the latest security threats
and/or version of PCI DSS.
Further Information
For additional guidance, refer to Information
Supplement: Best Practices for Implementing a
Security Awareness Program.

March 2022
Page 312

Requirements and Testing Procedures

Guidance

A3.2 PCI DSS scope is documented and validated.

Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.1 PCI DSS scope is documented andconfirmed for accuracy at least once every threemonths and upon significant changes to the inscope environment. At a minimum, the scoping
validation includes:

A3.2.1.a Examine documented results of scope
reviews and interview personnel to verify that thereviews are performed:•

Identifying all data flows for the various payment
stages (for example, authorization, capture,settlement, chargebacks, and refunds) andacceptance channels (for example, card-present,
card-not-present, and e-commerce).

•

Updating all data-flow diagrams per
Requirement 1.2.4.

•

Identifying all locations where account data isstored, processed, and transmitted, including but
not limited to 1) any locations outside of thecurrently defined CDE, 2) applications thatprocess CHD, 3) transmissions between
systems and networks, and 4) file backups.

•

•

•

•

At least once every three months.

•

After significant changes to the in-scope
environment.

A3.2.1.b Examine documented results of scope
reviews occurring at least once every three months
to verify that scoping validation includes allelements specified in this requirement.

For any account data found outside of thecurrently defined CDE, either 1) securely delete
it, 2) migrate it into the currently defined CDE, or3) expand the currently defined CDE to include
it.
Identifying all system components in the CDE,
connected to the CDE, or that could impact
security of the CDE.
Identifying all segmentation controls in use andthe environment(s) from which the CDE issegmented, including justification forenvironments being out of scope.

PurposeFrequent validation of PCI DSS scope helps toensure PCI DSS scope remains up to date andaligned with changing business objectives, andtherefore that security controls are protecting all
appropriate system components.
Good Practice
Accurate scoping involves critically evaluating the
CDE and all connected system components todetermine the necessary coverage for PCI DSS
requirements. Scoping activities, including carefulanalysis and ongoing monitoring, help to ensurethat in-scope systems are appropriately secured.
When documenting account data locations, theentity can consider creating a table or
spreadsheet that includes the following
information:•

Data stores (databases, files, cloud, etc.),
including purpose of data storage and theretention period,•

Which CHD elements are stored (PAN, expiry
date, cardholder name, and/or any elements of
SAD prior to completion of authorization),•

How data is secured (type of encryption andstrength, hashing algorithm and strength,
truncation, tokenization),

How access to data stores is logged, including
a description of logging mechanism(s) in use(enterprise solution, application level,
operating system level, etc.).
(continued on next page)•

Identifying all connections to third-party entities
with access to the CDE.
(continued on next page)•

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 313

Requirements and Testing Procedures
Confirming that all identified data flows, accountdata, system components, segmentation
controls, and connections from third parties withaccess to the CDE are included in scope.
PCI DSS Reference: Scope of PCI DSS
Requirements, Requirement 12.

•

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
In addition to internal systems and networks, allconnections from third-party entities—for
example, business partners, entities providing
remote support services, and other service
providers—need to be identified to determine
inclusion for PCI DSS scope. Once the in-scope
connections have been identified, the applicable
PCI DSS controls can be implemented to reduce
the risk of a third-party connection being used tocompromise an entity’s CDE.
A data discovery tool or methodology can be used
to facilitate identifying all sources and locations of
PAN, and to look for PAN that resides on systems
and networks outside the currently defined CDE
or in unexpected places within the defined CDE—
for example, in an error log or memory dump file.
This approach can help ensure that previously
unknown locations of PAN are detected and that
the PAN is either eliminated or properly secured.
Further Information
Refer to Information Supplement: Guidance for
PCI DSS Scoping and Network Segmentation for
additional guidance.

March 2022
Page 314

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.2 PCI DSS scope impact for all changes tosystems or networks is determined, including
additions of new systems and new network
connections. Processes include:A3.2.2 Examine change documentation andinterview personnel to verify that for each change
to systems or networks the PCI DSS scope impact
is determined, and includes all elements specified
in this requirement.

•

Performing a formal PCI DSS impact
assessment.

•

Identifying applicable PCI DSS requirements tothe system or network.

•

Updating PCI DSS scope as appropriate.

Documented sign-off of the results of the impact
assessment by responsible personnel (asdefined in A3.1.3).
PCI DSS Reference: Scope of PCI DSS
Requirements; Requirements 1-12•

Customized Approach Objective

Guidance
PurposeChanges to systems or networks can have asignificant impact on PCI DSS scope. For
example, changes to network security control
rulesets can bring whole network segments into
scope, or new systems may be added to the CDEthat have to be appropriately protected.
A formal impact assessment performed inadvance of a change gives the entity assurance
that the change will not adversely affect the
security of the CDE.
Good Practice
Processes to determine the potential impact thatchanges to systems and networks may have onan entity’s PCI DSS scope may be performed aspart of a dedicated PCI DSS compliance program
or may fall under an entity’s overarchingcompliance and/or governance program.

This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 315

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.2.1 Upon completion of a change, all relevant
PCI DSS requirements are confirmed to be
implemented on all new or changed systems andnetworks, and documentation is updated as
applicable.
PCI DSS Reference: Scope of PCI DSS
Requirements; Requirement 1-12

A3.2.2.1 Examine change records and the affected
systems/networks, and interview personnel toverify that all relevant PCI DSS requirements wereconfirmed to be implemented and documentation
updated as part of the change.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeIt is important to have processes to analyze allchanges made to systems or networks, to ensurethat all appropriate PCI DSS controls are applied
to any systems or networks added to the in-scope
environment due to a change.
Building this validation into change management
processes helps ensure that device inventories
and configuration standards are kept up to date,and security controls are applied where needed.
Good Practice
A change management process should include
supporting evidence that PCI DSS requirements
are implemented or preserved through an iterative
process.
ExamplesPCI DSS requirements that should be verified
include, but are not limited to:•

Network diagrams are updated to reflectchanges.

•

Systems are configured per configuration
standards, with all default passwords changed
and unnecessary services disabled.

•

Systems are protected with required controls—
for example, file integrity monitoring,anti-malware, patches, and audit logging.

•Sensitive authentication data is not stored, andthat all account data storage is documented
and incorporated into data-retention policy andprocedures.

•

New systems are included in the quarterly
vulnerability scanning process.

March 2022
Page 316

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.3 Changes to organizational structure result ina formal (internal) review of the impact to PCI DSS
scope and applicability of controls.
PCI DSS Reference: Requirement 12

A3.2.3 Examine policies and procedures to verify
that a change to organizational structure results informal a review of the impact on PCI DSS scope
and applicability of controls.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeAn organization’s structure and management
define the requirements and protocol for effective
and secure operations. Changes to this structure
could have negative effects to existing controls
and frameworks by reallocating or removing
resources that once supported PCI DSS controls
or inheriting new responsibilities that may nothave established controls in place. Therefore, it isimportant to revisit PCI DSS scope and controls
when there are changes to an organization’s
structure and management to ensure controls arein place and active.
ExamplesChanges to organizational structure include, but
are not limited to, company mergers or
acquisitions, and significant changes orreassignments of personnel with responsibility forsecurity control.

March 2022
Page 317

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.4 If segmentation is used, PCI DSS scope isconfirmed as follows:

A3.2.4 Examine the results from the most recent
penetration test to verify that the test was
conducted in accordance with all elements
specified in this requirement.

•

Per the entity’s methodology defined at
Requirement 11.4.1.

•

Penetration testing is performed on
segmentation controls at least once every six
months and after any changes to segmentation
controls/methods.

•

The penetration testing covers all segmentation
controls/methods in use.

The penetration testing verifies thatsegmentation controls/methods are operationaland effective, and isolate the CDE from all outof-scope systems.
PCI DSS Reference: Requirement 11•

Customized Approach Objective

Guidance
PurposePCI DSS normally requires segmentation controls
to be verified by penetration testing every twelve
months.
Validating segmentation controls more frequently
is likely to discover failings in segmentation before
they can be exploited by an attacker attempting topivot laterally from an out-of-scope untrusted
network to the CDE.
Good Practice
Although the requirement specifies that this scope
validation is carried out at least once every six
months and after a significant change, thisexercise should be performed as frequently as
possible to ensure it remains effective at isolating
the CDE from other networks.
Further Information
Refer to Information Supplement: Penetration
Testing Guidance for additional guidance.

This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 318Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.5 A data-discovery methodology isimplemented that:

A3.2.5.a Examine the documented data-discovery
methodology to verify it includes all elements
specified in this requirement.

•

Confirms PCI DSS scope.

•

Locates all sources and locations of cleartext
PAN at least once every three months andupon significant changes to the CDE orprocesses.

Addresses the potential for cleartext PAN toreside on systems and networks outside thecurrently defined CDE.
PCI DSS Reference: Scope of PCI DSS
Requirements•

A3.2.5.b Examine results from recent data
discovery efforts, and interview responsible
personnel to verify that data discovery is performedat least once every three months and uponsignificant changes to the CDE or processes.

Customized Approach Objective
This requirement is not eligible for the customized
approach

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposePCI DSS requires that, as part of the scoping
exercise, assessed entities must identify anddocument the existence of all cleartext PAN in
their environments. Implementing a datadiscovery methodology that identifies all sources
and locations of cleartext PAN and looks forcleartext PAN on systems and networks outside
the currently defined CDE or in unexpected
places within the defined CDE—for example, inan error log or memory dump file— helps toensure that previously unknown locations ofcleartext PAN are detected and properly secured.
ExamplesA data-discovery process can be performed via a
variety of methods, including, but not limited to 1)
commercially available data-discovery software,2) an in-house developed data-discovery
program, or 3) a manual search. A combination of
methodologies may also be used as needed.
Regardless of the method used, the goal of theeffort is to find all sources and locations ofcleartext PAN (not just in the defined CDE).

March 2022
Page 319

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.5.1 Data discovery methods are confirmed asfollows:

A3.2.5.1.a Interview personnel and review
documentation to verify:•

Effectiveness of methods is tested.

••

Methods are able to discover cleartext PAN on
all types of system components and file formats
in use.

The entity has a process in place to test theeffectiveness of methods used for data
discovery.

•

The process includes verifying the methods areable to discover cleartext PAN on all types ofsystem components and file formats in use.

The effectiveness of data-discovery methods is
confirmed at least once every 12 months.
PCI DSS Reference: Scope of PCI DSS
Requirements•

Customized Approach Objective

A3.2.5.1.b Examine the results of effectivenesstests to verify that the effectiveness of datadiscovery methods is confirmed at least once every
12 months.

This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeA process to test the effectiveness of the methods
used for data discovery ensures thecompleteness and accuracy of account datadetection.
Good PracticeFor completeness, system components in the inscope networks, and systems in out-of-scope
networks, should be included in the datadiscovery process.
The data-discovery process should be effectiveon all operating systems and platforms in use.
Accuracy can be tested by placing test PANs on
system components and file formats in use andconfirming that the data-discovery method
detected the test PANs.

March 2022
Page 320

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.5.2 Response procedures are implemented to
be initiated upon the detection of cleartext PAN
outside the CDE to include:A3.2.5.2.a Examine documented response
procedures to verify that procedures for responding
to the detection of cleartext PAN outside the CDE
are defined and include all elements specified inthis requirement.

•

Determining what to do if cleartext PAN is
discovered outside the CDE, including its
retrieval, secure deletion, and/or migration into
the currently defined CDE, as applicable.

•

Determining how the data ended up outside the
CDE.

•

Remediating data leaks or process gaps that
resulted in the data being outside the CDE.

•

Identifying the source of the data.

•

Identifying whether any track data is stored with
the PANs.

A3.2.5.2.b Interview personnel and examine
records of response actions to verify that
remediation activities are performed when cleartext
PAN is detected outside the CDE.

Customized Approach Objective

Guidance
PurposeHaving documented response procedures that are
followed in the event cleartext PAN is foundoutside the CDE helps to identify the necessary
remediation actions and prevent future leaks.
Good Practice
If PAN was found outside the CDE, an analysis
should be performed to 1) determine whether it
was saved independently of other data or withsensitive authentication data, 2) to identify thesource of the data, and 3) identify the control gapsthat resulted in the data being outside the CDE.
Entities should consider whether contributory
factors, such as business processes, user
behavior, improper system configurations, etc.,
caused the PAN to be stored in an unexpected
location. If such contributory factors are present,
they should be addressed per this Requirement toprevent a recurrence.

This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 321

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.6 Mechanisms are implemented for detecting
and preventing cleartext PAN from leaving the CDE
via an unauthorized channel, method, or process,including mechanisms that are:A3.2.6.a Examine documentation and observe
implemented mechanisms to verify that themechanisms are in accordance with all elements
specified in this requirement.

•

Actively running.

•

Configured to detect and prevent cleartext PAN
leaving the CDE via an unauthorized channel,
method, or process.

A3.2.6.b Examine audit logs and alerts, andinterview responsible personnel to verify that alerts
are investigated.

Generating audit logs and alerts upon detectionof cleartext PAN leaving the CDE via an
unauthorized channel, method, or process.
PCI DSS Reference: Scope of PCI DSS
Requirements, Requirement 12•

Guidance
PurposeThe use of mechanisms to detect and prevent
unauthorized PAN from leaving the CDE allows
an organization to detect and prevent situations
that may lead to data loss.
Good Practice
Coverage of the mechanisms should include, but
not be limited to, e-mails, downloads to removable
media, and output to printers.
ExamplesMechanisms to detect and prevent unauthorized
loss of cleartext PAN may include the use of
appropriate tools such as data loss prevention(DLP) solutions as well as manual processes andprocedures.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 322

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.2.6.1 Response procedures are implemented to
be initiated upon the detection of attempts toremove cleartext PAN from the CDE via an
unauthorized channel, method, or process.
Response procedures include:A3.2.6.1.a Examine documented response
procedures to verify that procedures for responding
to the attempted removal of cleartext PAN from theCDE via an unauthorized channel, method, orprocess include all elements specified in thisrequirement:•

Procedures for the prompt investigation of alerts
by responsible personnel.

Procedures for remediating data leaks orprocess gaps, as necessary, to prevent any dataloss.
PCI DSS Reference: Requirement 12•

Customized Approach Objective
This requirement is not eligible for the customized
approach.

•

Procedures for the prompt investigation ofalerts by responsible personnel.

•

Procedures for remediating data leaks orprocess gaps, as necessary, to prevent any
data loss.

Guidance
PurposeAttempts to remove cleartext PAN via an
unauthorized channel, method, or process may
indicate malicious intent to steal data, or may be
the actions of an authorized employee who isunaware of or simply not following the proper
methods. Prompt investigation of theseoccurrences can identify where remediationneeds to be applied and provides valuable
information to help understand from where thethreats are coming.

A3.2.6.1.b Interview personnel and examine
records of actions taken when cleartext PAN is
detected leaving the CDE via an unauthorizedchannel, method, or process and verify that
remediation activities were performed.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 323

Requirements and Testing Procedures

Guidance

A3.3 PCI DSS is incorporated into business-as-usual (BAU) activities.

Defined Approach Requirements

Defined Approach Testing ProceduresA3.3.1 Failures of critical security control systems
are detected, alerted, and addressed promptly,
including but not limited to failure of:A3.3.1.a Examine documented policies andprocedures to verify that processes are defined topromptly detect, alert, and address critical security
control failures in accordance with all elements
specified in this requirement.

•

Network security controls•

IDS/IPS•

FIM•

Anti-malware solutions•

Physical access controls•

Logical access controls•

Audit logging mechanisms•

Segmentation controls (if used)•

Automated audit log review mechanisms. Thisbullet is a best practice until its effective date;refer to Applicability Notes below for details.

A3.3.1.b Examine detection and alerting
processes, and interview personnel to verify thatprocesses are implemented for all critical security
controls specified in this requirement and that eachfailure of a critical security control results in thegeneration of an alert.

PurposeWithout formal processes for the prompt (as soon
as possible) detection, alerting, and addressing of
critical security control failures, failures may goundetected or remain unresolved for extended
periods. In addition, without formalized timebound processes, attackers will have ample time
to compromise systems and steal account datafrom the CDE.
Good PracticeThe specific types of failures may vary, dependingon the function of the device system component
and technology in use. Typical failures include asystem ceasing to perform its security function or
not functioning in its intended manner, such as afirewall erasing all its rules or going offline.

Automated code review tools (if used). Thisbullet is a best practice until its effective date;refer to Applicability Notes below for details.
PCI DSS Reference: Requirements 1-12•

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Applicability Notes
The bullets above (for automated log review
mechanisms and automated code review tools (ifused)) are best practices until 31 March 2025, after
which they will be required as part of Requirement
A3.3.1 and must be fully considered during a PCI
DSS assessment.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 324

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.3.1.2 Failures of any critical security control
systems are responded to promptly. Processes forresponding to failures in security control systems
include:A3.3.1.2.a Examine documented policies andprocedures and interview personnel to verify
processes are defined and implemented torespond promptly to a security control failure inaccordance with all elements specified in thisrequirement.

•

Restoring security functions.

•

Identifying and documenting the duration (dateand time from start to end) of the security failure.

•

Identifying and documenting the cause(s) of
failure, including root cause, and documenting
remediation required to address the root cause.

••

Identifying and addressing any security issues
that arose during the failure.

Identification of cause(s) of the failure, including
root cause.

••

Determining whether further actions are required
as a result of the security failure.

Duration (date and time start and end) of the
security failure.

••

Implementing controls to prevent the cause of
failure from reoccurring.

Details of the remediation required to address
the root cause.

A3.3.1.2.b Examine records to verify that security
control failures are documented to include:

Guidance
PurposeIf alerts from failures of critical security control
systems are not responded to quickly andeffectively, attackers may use this time to insert
malicious software, gain control of a system, or
steal data from the entity’s environment.
Good Practice
Documented evidence (for example, records
within a problem management system) should
support processes and procedures in place that
respond to security failures. In addition, personnel
should be aware of their responsibilities in theevent of a failure. Actions and responses to thefailure should be captured in the documented
evidence.

• Resuming monitoring of security controls.
PCI DSS Reference: Requirements 1-12

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 325

Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.3.2 Hardware and software technologies arereviewed at least once every 12 months to confirm
whether they continue to meet the organization’s
PCI DSS requirements.
PCI DSS Reference: Requirements 2, 6, 12.

A3.3.2.a Examine documented policies andprocedures and interview personnel to verify
processes are defined and implemented to review
hardware and software technologies to confirm
whether they continue to meet the organization’s
PCI DSS requirements.
A3.3.2.b Review the results of the recent reviewsof hardware and software technologies to verify
reviews are performed at least once every 12
months.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

A3.3.2.c Review documentation to verify that, for
any technologies that have been determined to nolonger meet the organization’s PCI DSS
requirements, a plan is in place to remediate thetechnology.

Applicability Notes
The process includes a plan for remediating
technologies that no longer meet the organization’s
PCI DSS requirements, up to and including
replacement of the technology, as appropriate.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Guidance
PurposeHardware and software technologies areconstantly evolving, and organizations need to beaware of changes to the technologies they use, as
well as the evolving threats to those technologies.
Conducting appropriate reviews of thesetechnologies ensures that they can prepare for,and manage, vulnerabilities in hardware andsoftware that will not be remediated by the vendor
or developer.
Good Practice
Organizations should also consider reviewing
firmware versions to ensure they remain current
and supported by the vendors.
Organizations also need to be aware of changes
made by technology vendors to their products orprocesses to understand how such changes may
impact the organization’s use of the technology.
Regular reviews of technologies that impact or
influence PCI DSS controls can assist withpurchasing, usage, and deployment strategies
and ensure controls that rely on thosetechnologies remain effective. These reviews
include, but are not limited to, reviewing
technologies that are no longer supported by thevendor and/or no longer meet the security needsof the organization.

March 2022
Page 326Requirements and Testing Procedures
Defined Approach Requirements

Defined Approach Testing ProceduresA3.3.3 Reviews are performed at least once every
three months to verify BAU activities are being
followed. Reviews are performed by personnel
assigned to the PCI DSS compliance program (asidentified in A3.1.3), and include:A3.3.3.a Examine policies and procedures to verify
that processes are defined for reviewing andverifying BAU activities in accordance with allelements specified in this requirement.

•

Confirmation that all BAU activities, includingA3.2.2, A3.2.6, and A3.3.1, are being performed.

•

Confirmation that personnel are following
security policies and operational procedures (forexample, daily log reviews, ruleset reviews for
network security controls, configuration
standards for new systems).

•

Documenting how the reviews were completed,including how all BAU activities were verified as
being in place.

•

Collection of documented evidence as required
for the annual PCI DSS assessment.

•

Review and sign-off of results by personnel
assigned responsibility for the PCI DSS
compliance program, as identified in A3.1.3.

A3.3.3.b Interview responsible personnel andexamine records of reviews to verify that:•

Reviews are performed by personnel assigned
to the PCI DSS compliance program.

•

Reviews are performed at least once every
three months.

Retention of records and documentation for atleast 12 months, covering all BAU activities.
PCI DSS Reference: Requirements 1-12•

Guidance
PurposeRegularly confirming that security policies andprocedures are being followed provides
assurance that the expected controls are active
and working as intended. The objective of thesereviews is not to reperform other PCI DSS
requirements, but to confirm that security activities
are being performed on an ongoing basis.
Good Practice
These reviews can also be used to verify thatappropriate evidence is being maintained—for
example, audit logs, vulnerability scan reports,
reviews of network security control rulesets—toassist in the entity’s preparation for its next PCI
DSS assessment.
ExamplesLooking at Requirement 1.2.7 as one example,
Requirement A3.3.3 is met by confirming, at least
once every three months, that reviews ofconfigurations of network security controls haveoccurred at the required frequency. On the other
hand, Requirement 1.2.7 is met by reviewing
those configurations as specified in therequirement.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 327

Requirements and Testing Procedures

Guidance

A3.4 Logical access to the cardholder data environment is controlled and managed.

Defined Approach Requirements

Defined Approach Testing ProceduresA3.4.1 User accounts and access privileges to inscope system components are reviewed at least
once every six months to ensure user accounts andaccess privileges remain appropriate based on job
function, and that all access is authorized.
PCI DSS Reference: Requirement 7

A3.4.1 Interview responsible personnel andexamine supporting documentation to verify that:

Customized Approach Objective•

User accounts and access privileges arereviewed at least every six months.

•

Reviews confirm that access is appropriate
based on job function and that all access is
authorized.

This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeRegular review of access rights helps to detect
excessive access rights remaining after user job
responsibilities change, system functions change,or other modifications. If excessive user rights are
not revoked in due time, they may be used bymalicious users for unauthorized access.
This review provides another opportunity toensure that accounts for all terminated users havebeen removed (if any were missed at the time oftermination), as well as to ensure that any third
parties that no longer need access have had theiraccess terminated.

March 2022
Page 328Requirements and Testing Procedures

Guidance

A3.5 Suspicious events are identified and responded to.

Defined Approach Requirements

Defined Approach Testing ProceduresA3.5.1 A methodology is implemented for the
prompt identification of attack patterns andundesirable behavior across systems that includes:

A3.5.1.a Examine documentation and interview
personnel to verify a methodology is defined andimplemented to identify attack patterns andundesirable behavior across systems in a prompt
manner, and includes all elements specified in thisrequirement.

•

Identification of anomalies or suspicious activity
as it occurs.

•

Issuance of prompt alerts upon detection of
suspicious activity or anomaly to responsible
personnel.

Response to alerts in accordance with
documented response procedures.
PCI DSS Reference: Requirements 10, 12•

A3.5.1.b Examine incident response procedures
and interview responsible personnel to verify that:•

On-call personnel receive prompt alerts.

•

Alerts are responded to per documented
response procedures.

Customized Approach Objective
This requirement is not eligible for the customized
approach.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PurposeThe ability to identify attack patterns andundesirable behavior across systems—for
example, using centrally managed or automatedlog-correlation tools— is critical in preventing,detecting, or minimizing the impact of a datacompromise. The presence of logs in allenvironments allows thorough tracking, alerting,and analysis when something goes wrong.
Determining the cause of a compromise is very
difficult, if not impossible, without a process tocorroborate information from critical systemcomponents and systems that perform security
functions, such as network security controls,
IDS/IPS, and file integrity monitoring (FIM)
systems. Thus, logs for all critical systemcomponents and systems that perform security
functions need to be collected, correlated, andmaintained. This could include using software
products and service methodologies to provide
real-time analysis, alerting, and reporting, such as
security information and event management(SIEM), FIM, or change detection.

March 2022
Page 329

Appendix B

Compensating ControlsCompensating controls may be considered when an entity cannot meet a PCI DSS requirement explicitly as stated, due to legitimate anddocumented technical or business constraints but has sufficiently mitigated the risk associated with the requirement through implementation ofother, or compensating, controls.
Compensating controls must satisfy the following criteria:
1. Meet the intent and rigor of the original PCI DSS requirement.
2. Provide a similar level of defense as the original PCI DSS requirement, such that the compensating control sufficiently offsets the riskthat the original PCI DSS requirement was designed to defend against. To understand the intent of a requirement, see the Customized
Approach Objective for most PCI DSS requirements. If a requirement is not eligible for the Customized Approach and therefore does nothave a Customized Approach Objective, refer to the Purpose in the Guidance column for that requirement.
3. Be “above and beyond” other PCI DSS requirements. (Simply being in compliance with other PCI DSS requirements is not acompensating control.)4. When evaluating “above and beyond” for compensating controls, consider the following:
Note: All compensating controls must be reviewed and validated for sufficiency by the assessor who conducts the PCI DSS
assessment. The effectiveness of a compensating control is dependent on the specifics of the environment in which the control isimplemented, the surrounding security controls, and the configuration of the control. Entities should be aware that a given compensating
control will not be effective in all environments.
a. Existing PCI DSS requirements CANNOT be considered as compensating controls if they are already required for the item underreview. For example, passwords for non-console administrative access must be sent encrypted to mitigate the risk of intercepting
cleartext administrative passwords. An entity cannot use other PCI DSS password requirements (intruder lockout, complex
passwords, etc.) to compensate for lack of encrypted passwords, since those other password requirements do not mitigate the riskof interception of cleartext passwords. Also, the other password controls are already PCI DSS requirements for the item underreview (passwords).
b. Existing PCI DSS requirements MAY be considered as compensating controls if they are required for another area but are notrequired for the item under review.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 330

c.

Existing PCI DSS requirements may be combined with new controls to become a compensating control. For example, if a company
is unable to address a vulnerability that is exploitable through a network interface because a security update is not yet available
from a vendor, a compensating control could consist of controls that include all of the following: 1) internal network segmentation, 2)
limiting network access to the vulnerable interface to only required devices (IP address or MAC address filtering), and 3) IDS/IPS
monitoring of all traffic destined to the vulnerable interface.

5. Address the additional risk imposed by not adhering to the PCI DSS requirement.
6. Address the requirement currently and in the future. A compensating control cannot address a requirement that was missed in the past(for example, where performance of a task was required two quarters ago, but that task was not performed).
The assessor is required to thoroughly evaluate compensating controls during each annual PCI DSS assessment to confirm that eachcompensating control adequately addresses the risk that the original PCI DSS requirement was designed to address, per items 1-6 above.
To maintain compliance, processes and controls must be in place to ensure compensating controls remain effective after the assessment iscomplete. Additionally, compensating control results must be documented in the applicable report for the assessment (for example, a Reporton Compliance or a Self-Assessment Questionnaire) in the corresponding PCI DSS requirement section, and included when the applicable
report is submitted to the requesting organization.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 331

Appendix C

Compensating Controls Worksheet

The entity must use this worksheet to define compensating controls for any requirement where compensating controls are used to meet a PCI
DSS requirement. Note that compensating controls should also be documented in accordance with instructions in the Report on Compliance inthe corresponding PCI DSS requirement section.
Note: Only entities that have legitimate and documented technological or business constraints can consider the use of compensating controls
to achieve compliance.
Requirement Number and Definition:
Information Required
1. Constraints

Document the legitimate technical or businessconstraints precluding compliance with theoriginal requirement.

2. Definition of Compensating Controls

Define the compensating controls: explain how
they address the objectives of the originalcontrol and the increased risk, if any.

3. Objective

Define the objective of the original control (forexample, the Customized Approach Objective).

Explanation

Identify the objective met by the compensating
control (note: this can be, but is not required tobe, the stated Customized Approach Objective
for the PCI DSS requirement).
4. Identified Risk

Identify any additional risk posed by the lack of
the original control.

5. Validation of Compensating Controls

Define how the compensating controls werevalidated and tested.

6. MaintenanceDefine process(es) and controls in place tomaintain compensating controls.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 332

Appendix D

Customized ApproachThis approach is intended for entities that decide to meet a PCI DSS requirement’s stated Customized Approach Objective in a way that does
not strictly follow the defined requirement. The customized approach allows an entity to take a strategic approach to meeting a requirement’s
Customized Approach Objective, so it can determine and design the security controls needed to meet the objective in a manner unique for thatorganization.
The entity implementing a customized approach must satisfy the following criteria:Document and maintain evidence about each customized control, including all information specified in the Controls Matrix Template inAppendix E1.



Perform and document a targeted risk analysis (PCI DSS Requirement 12.3.2) for each customized control, including all information
specified in the Targeted Risk Analysis Template in Appendix E2.



Perform testing of each customized control to prove effectiveness, and document testing performed, methods used, what was tested,when testing was performed, and results of testing in the controls matrix.

Monitor and maintain evidence about the effectiveness of each customized control.

Provide completed controls matrix(es), targeted risk analysis, testing evidence, and evidence of customized control effectiveness to its
assessor.

The assessor performing an assessment of customized controls must satisfy the following criteria:


Review the entity’s controls matrix(es), targeted risk analysis, and evidence of control effectiveness to fully understand the customized
control(s) and to verify the entity meets all Customized Approach documentation and evidence requirements.



Derive and document the appropriate testing procedures needed to conduct thorough testing of each customized control.



Test each customized control to determine whether the entity’s implementation 1) meets the requirement’s Customized Approach
Objective and 2) results in an “in place” finding for the requirement.

At all times, QSAs maintain independence requirements defined in the QSA Qualification Requirements. This means if a QSA is
involved in designing or implementing a customized control, that QSA does not also derive testing procedures for, assess, or assist withthe assessment of that customized control.

The entity and its assessor are expected to work together to ensure 1) they agree that the customized control(s) fully meets the customized
approach objective, 2) the assessor fully understands the customized control, and 3) the entity understands the derived testing the assessor
will perform.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 333

Use of the customized approach must be completed by a QSA or ISA and documented in accordance with instructions in the Report on
Compliance (ROC) Template and following the instructions in the FAQs for use with PCI DSS v4.0 ROC Template available on the PCI SSC
website.
Entities that complete a Self-Assessment Questionnaire are not eligible to use a customized approach; however, these entities may elect tohave a QSA or ISA perform their assessment and document it in a ROC Template.
The use of the customized approach may be regulated by organizations that manage compliance programs (for example, payment brands andacquirers). Therefore, questions about use of a customized approach must be referred to those organizations, including, for example, whether
an entity is required to use a QSA, or may use an ISA to complete an assessment using the customized approach.
Note: Compensating controls are not an option with the customized approach. Because the customized approach allows an entity todetermine and design the controls needed to meet a requirement’s Customized Approach Objective, the entity is expected to effectively
implement the controls it designed for that requirement without needing to also implement alternate, compensating controls.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 334

Appendix E

Sample Templates to Support Customized ApproachThis appendix contains example templates for the controls matrix and a targeted risk analysis, to be documented by the entity as part of thecustomized approach. These templates are examples of formats that could be used. While it is not required that entities follow the specificformats provided in this appendix, the entity’s control matrix and targeted risk analysis must include all the information as defined in thesetemplates.

E1 Sample Controls Matrix Template
The following is a sample controls matrix template that an entity may use to document their customized implementation.
As described in Appendix D: Customized Approach, entities using the customized approach must complete a controls matrix to provide details
for each implemented control that explain what is implemented, how the entity has determined that the controls meet the stated objective of a
PCI DSS requirement, how the control provides at least the equivalent level of protection as would be achieved by meeting the definedrequirement, and how the entity has assurance about the effectiveness of the control on an ongoing basis.
The assessor uses the information within each controls matrix to plan and prepare for the assessment.
This sample controls matrix template includes the minimum information to be documented by the entity and provided to the assessor for acustomized validation. While it is not required that this specific template be used, it is required that the entity’s customized approach
documentation includes all information defined in this template, and that the entity provides this exact information to its assessor.
The controls matrix does not replace the need for the assessor to independently develop appropriate testing procedures forvalidating the implemented controls. The assessor must still perform the necessary testing to verify the controls meet the objective of therequirement, are effective, and are properly maintained. The controls matrix also does not replace the reporting requirements for customized
validations as specified in the ROC Template.
The controls matrix must include at least the information in the following table.
Sample Controls Matrix Template for PCI DSS Requirements met via the Customized Approach
To be completed by the entity being assessed
Customized control name/identifier<Entity defines how they want to refer to this control>

PCI DSS Requirement(s) number and objective(s) that is met with thiscontrol(s)Requirement #:Requirement #:Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Objective:
Objective:

March 2022
Page 335

Sample Controls Matrix Template for PCI DSS Requirements met via the Customized Approach
To be completed by the entity being assessed
Details of control(s)What is the implemented control(s)?

<Entity describes what the control is and what it does>

Where is the control(s) implemented?

<Entity identifies locations of facilities and system components where control isimplemented and managed>

When is the control(s) performed?

<Entity details how frequently the control is performed – for example, runs
continuously in real time or is scheduled to run at NN times and at XX intervals>

Who has overall responsibility and accountability for the control(s)?

<Entity includes details of individual personnel/roles with responsibility andaccountability for this control>

Who is involved in managing, maintaining, and monitoring thecontrol(s)?

<Entity includes details of individual personnel/roles and/or teams, as applicable,that manage, maintain, and monitor the control>

For each PCI DSS requirement the control(s) is used for, the entity provides details of the following:
Entity describes how the implemented control(s) meets the stated
Customized Approach Objective of the PCI DSS requirement.

<Entity describes how the control meets the stated customized approachobjective of the PCI DSS requirement, and summarizes related results>

Entity describes testing it performed and the results of that testingthat demonstrates the control(s) meets the objective of the applicablerequirement.

<Entity describes the testing it performed to prove the control meets the statedobjective of the PCI DSS requirement, and summarizes related results>

Entity briefly describes the results of the separate targeted risk
analysis it performed that explains the control(s) implemented anddescribes how the results verify the control(s) provides at least an
equivalent level of protection as the defined approach for theapplicable PCI DSS requirement. See the separate Targeted Risk
Analysis Template for details on how to document this risk analysis.

<Entity briefly describes the results of its risk analysis for this control, which isdetailed separately in the Targeted Risk Analysis>

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 336

Sample Controls Matrix Template for PCI DSS Requirements met via the Customized Approach
To be completed by the entity being assessed
Entity describes the measures it has implemented to ensure thecontrol(s) is maintained and its effectiveness is assured on an ongoingbasis. For example, how the entity monitors for control effectiveness,
how control failures are detected and responded to, and the actions
taken.

<Entity describes how it ensures the control is maintained and how the control's
effectiveness is assured.>

E2 Sample Targeted Risk Analysis Template
The following is a sample targeted risk analysis template an entity may use for their customized implementation. While it is not required that anentity follow this specific format, its customized approach documentation must include all the information defined in this template.
As described in Appendix D: Customized Approach and in accordance with PCI DSS Requirement 12.3.2, an entity using the customized
approach must provide a detailed targeted risk analysis for each requirement the entity is meeting with the customized approach. The risk
analysis defines the risk, evaluates the effect on security if the defined requirement is not met, and describes how the entity has determinedthat the controls provide at least an equivalent level of protection as provided by the defined PCI DSS requirement.
The assessor uses the information in the targeted risk analysis to plan and prepare for the assessment.
In completing a targeted risk analysis for a customized approach, it is important to remember that:

Note: The term “mischief” as usedin this targeted risk analysis (forexample, in 1.3 in the table below)
refers to an occurrence or eventthat negatively affects the security
posture of the entity. Examples ofthis are the absence of a policy, thefailure to conduct a vulnerability
scan, or that malware executes inthe entity’s environment.



The asset being protected is the cardholder data that is stored, processed, or transmitted by
the entity.

The threat actor is highly motivated and capable. The motivation and capability of threat actors
tends to increase in relation to the volume of cardholder data that a successful attack willrealize.

The likelihood that an entity will be targeted by threat actors increases as the entity stores,
processes, or transmits greater volumes of cardholder data.

The mischief is directly related to the objective. For example, if the objective is “malicious
software cannot execute”, the mischief is that malicious software executes; if the objective is “day-to-day responsibilities for performing
all the activities are allocated”, the mischief is that the responsibilities are not allocated.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 337

This sample targeted risk analysis template includes the minimum information to be documented by the entity and provided to the assessor fora customized validation. While it is not required that this specific template be used, it is required that the entity’s customized approach
documentation include all information defined in this template, and that the entity provides this exact information to its assessor.
The targeted risk analysis must include at least the information in the following table.
Sample Targeted Risk Analysis for PCI DSS Requirements met via the Customized Approach
To be completed by the entity being assessed
Item

Details

1. Identify the requirement
1.1 Identify the PCI DSS requirement as written.

<Entity identifies the requirement>

1.2 Identify the objective of the PCI DSS requirement as
written.

<Entity identifies the objective of the requirement>

1.3 Describe the mischief that the requirement was
designed to prevent<Entity describes the mischief><Entity describes the effect on its security if the objective is not successfully met by the entity.><Entity describes which security fundamentals would not be in place, or what a threat actor may
be able to do if the objective is not successfully met by the entity.>

2. Describe the proposed solution
2.1 Customized control name/identifier<Entity identifies the customized control as documented in the Controls Matrix.>

2.2 What parts of the requirement as written will change
in the proposed solution?

<Entity identifies what elements of the requirement will not be met by the defined approach and so
will be covered by customized approach. This could be as small as changing the periodicity of arequirement, or the implementation of a completely different set of controls to meet the objective.>

2.3 How will the proposed solution prevent the mischief?

<Entity describes how the controls detailed in the Controls Matrix will prevent the mischief
identified in 1.3.>

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 338Sample Targeted Risk Analysis for PCI DSS Requirements met via the Customized Approach
To be completed by the entity being assessed
Item

Details

3. Analyze any changes to the LIKELIHOOD of the mischief occurring, leading to a breach in confidentiality of cardholder data
3.1 Describe the factors detailed in the Control Matrix
that affect the likelihood of the mischief occurring.

3.2 Describe the reasons the mischief may still occur
after the application of the customized control.

Entity describes:•

How successful the controls will be at preventing the mischief•

How the controls detailed in the Control Matrix reduce the likelihood of the mischief occurring

Entity describes:•

The typical reasons for the control to fail, the likelihood of this, and how could it be prevented•

How resilient the entity’s processes and systems are for detecting that the control(s) are notoperating normally?

•

How a threat actor could bypass this control – what steps would they need to take, how hard
is it, would the threat actor be detected before the control failed? How has this been
determined?

3.3 To what extent do the controls detailed in thecustomized approach represent a change in thelikelihood of the mischief occurring when compared withthe defined approach requirement?

Mischief more
likely to occur

3.4 Provide the reasoning for your assessment of thechange in likelihood that the mischief occurs once thecustomized controls are in place.

Entity provides:

No change

Mischief lesslikely to occur•

The justification for the assessment documented at 3.3.

•

The criteria and values used for the assessment documented at 3.3.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 339

Sample Targeted Risk Analysis for PCI DSS Requirements met via the Customized Approach
To be completed by the entity being assessed
Item

Details

4. Analyze any changes to the IMPACT of unauthorized access to account data
4.1 For the scope of system components that thissolution covers what volume of account data would be atrisk of unauthorized access if the solution failed?

4.1.1 Number ofstored PANs

4.2 Description of how the customized controls will
directly:

Impact to the payment ecosystem is directly related to the number of accounts compromised andhow quickly any compromised PANs can be blocked by the card issuer.
Entity describes how the customized controls achieve the following if any of the customized
controls:•

Reduce the number of individual PANs compromised
if a threat actor is successful, and/or•

Allow quicker notification of the PANs compromised
to the card brands.

Maximum at
any one time

4.1.2 Number of PANs processed ortransmitted over a 12-month period

Total

•

Reduce the volume of cardholder data that is stored, processed, or transmitted and therefore
reduce what is available to a successful threat actor, and/or•

Decrease the time to detection, notification of compromised accounts, and containment of thethreat actor.

5. Risk approval and review
5.1 I have reviewed the above risk analysis and I agree
that the use of the proposed customized approach asdetailed provides at least an equivalent level of protection
as the defined approach for the applicable PCI DSS
requirement.

A member of executive management must review and agree to the proposed customized
approach.
<Member of entity’s executive management signs that it reviewed and agreed to the customized
approach documented herein.>

5.2 This risk analysis must be reviewed and updated nolater than:The risk analysis should be reviewed at least every twelve months and more frequently if thecustomized approach itself is time limited (for example, because there is a planned change intechnology) or if other factors dictate a needed change. In the event of an unscheduled risk
review, detail the reason the review occurred.
<Entity indicates date the targeted risk analysis was reviewed and updated.>

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 340

Appendix F Leveraging the PCI Software Security Framework to Support
Requirement 6
PCI DSS Requirement 6 defines requirements for the development and maintenance of secure systems and software. Because the PCI SSC
Secure Software Standard and the Secure SLC Standard (collectively, the Software Security Framework) include rigorous software security
requirements, the use of bespoke and custom software that is developed and maintained in accordance with either standard can help theentity to meet several requirements in PCI DSS Requirement 6 without having to perform additional detailed testing, and may also support useof the Customized Approach for other requirements. For details, see Table 7.
Note: This support for meeting Requirement 6 applies only to software that is specifically developed and maintained in accordance with the
Secure Software Standard or the Secure SLC Standard; it does not extend to other software or system components in scope for
Requirement 6.

Table 7. Leveraging the PCI Software Security Framework to Support Requirement 6
PCI DSS Requirements

6.1 Processes and mechanisms for
performing activities in Requirement 6 aredefined and understood.

How PCI DSS Requirements Apply to
Software Developed and Maintained in
Accordance with the Secure SoftwareStandard

How PCI DSS Requirements Apply to
Software Developed and Maintained in
Accordance with the Secure SLC Standard

PCI DSS requirements/objectives apply as usual.

6.2 Bespoke and custom software isdeveloped securely.

PCI DSS Requirement 6.2.4 can be considered inplace for software that is developed andmaintained in accordance with the Secure
Software Standard.

6.3 Security vulnerabilities are identified
and promptly addressed.

PCI DSS requirements/objectives apply as usual.
Software developed and maintained in accordance with the Secure SLC Standard may support thecustomized approach for Requirement 6.3 objectives.
While use of software developed and maintained in accordance with the Secure SLC Standard provides
assurance that the vendor makes security patches and software updates available in a timely manner, theentity retains responsibility for ensuring that patches and updates are installed in accordance with PCI
DSS requirements.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

PCI DSS Requirement 6.2 can be considered in place
for software that is developed and maintained inaccordance with the Secure SLC Standard.

March 2022
Page 341

PCI DSS Requirements

6.4 Public-facing web applications areprotected against attacks.
6.5 Changes to all system components aremanaged securely.

How PCI DSS Requirements Apply to
Software Developed and Maintained in
Accordance with the Secure SoftwareStandard

How PCI DSS Requirements Apply to
Software Developed and Maintained in
Accordance with the Secure SLC Standard

PCI DSS requirements/objectives apply as usual.
PCI DSS requirements/objectives apply as usual.
Software developed and maintained in accordance with the Secure SLC Standard may support thecustomized approach for Requirement 6.5 objectives.
While use of software developed and maintained in accordance with the Secure SLC Standard provides
assurance that the vendor follows change management procedures during development of software andrelated updates, the entity retains responsibility for ensuring that software and other changes to systemcomponents are implemented into its production environment in accordance with PCI DSS requirements.

Use of Bespoke and Custom Software Developed and Maintained by a Secure SLC Qualified Vendor
When validating the use of software developed and maintained by a Secure SLC Qualified Vendor to meet PCI DSS Requirement 6.2 andsupport the Customized Approach for Requirements 6.3 and 6.5, the assessor must confirm that the following is met:

The software vendor has a current listing on the PCI SSC List of Secure SLC Qualified Vendors—that is, the validation has not expired.



The software was developed and is being maintained using software lifecycle management practices that were assessed as part of thesoftware vendor’s validation.

The entity is following the implementation guidance provided by the Secure SLC Qualified Vendor.

Use of Bespoke and Custom Software Developed in Accordance with the Secure SLC Standard
Entities that internally develop software solely for their use or that develop software for use by a single entity may choose to engage a Secure
SLC Assessor to assess their software lifecycle management practices against the Secure SLC Standard. The Secure SLC Assessor will
document the results of the assessment in a Secure SLC Report on Compliance (ROC) and a Secure SLC Attestation of Compliance (AOC).
Software that is developed and maintained following software lifecycle management practices provides the same support for PCI DSS
Requirement 6 as software developed and maintained by a Secure SLC Qualified Vendor, if those practices were assessed by a Secure SLC
Assessor and confirmed to meet the Secure SLC Standard requirements, with the results documented in a Secure SLC ROC and AOC.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 342

Validating the Use of the Secure SLC Standard
When validating the use of software developed and maintained in accordance with the Secure SLC Standard to meet PCI DSS Requirement
6.2 and support customized approach for Requirements 6.3 and 6.5, the assessor must confirm that the following are met:

The software lifecycle management practices were assessed by a Secure SLC Assessor and confirmed to meet all Secure SLC
Standard requirements with the results documented in a Secure SLC Report on Compliance (ROC) and Secure SLC Attestation ofCompliance (AOC).

The software was developed and maintained using the software lifecycle management practices covered by the Secure SLC
assessment.



A full Secure SLC assessment of the software lifecycle management practices was completed within the previous 36 months.
Additionally, if the most recent full Secure SLC assessment occurred more than 12 months ago, an Annual Attestation was provided by
the developer/vendor within the previous 12 months that confirms continued adherence to Secure SLC Standard for the software
lifecycle management practices in use.

Validating the Use of the Secure Software Standard
When validating the use of software developed and maintained in accordance with the Secure Software Standard to meet PCI DSS
Requirement 6.2.4 and support customized approach for Requirements 6.3 and 6.5, the assessor must confirm that the following are met:

The secure software assessment was conducted by a Secure Software Assessor and confirmed to meet all requirements in the Secure
Software Standard with the results documented in a Secure Software Report on Validation (ROV) and Secure Software Attestation of
Validation (AOV).

The software was developed and is being maintained using the software lifecycle management practices that were covered by the
Secure Software assessment.



A full Secure Software assessment was completed within the previous 36 months. Additionally, if the most recent full Secure Software
assessment occurred more than 12 months ago, an Annual Attestation was provided by the developer/vendor within the previous 12
months that confirms continued adherence to Secure Software Standard.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 343

Appendix G

PCI DSS Glossary of Terms, Abbreviations, and Acronyms

Term

Definition

Account

Also referred to as “user ID,” “account ID,” or “application ID.” Used to identify an individual or process on a computer system. See
Authentication Credentials and Authentication Factor.

Account Data

Account data consists of cardholder data and/or sensitive authentication data. See Cardholder Data and Sensitive Authentication
Data.

Acquirer

Also referred to as “merchant bank,” “acquiring bank,” or “acquiring financial institution.” Entity, typically a financial institution, thatprocesses payment card transactions for merchants and is defined by a payment brand as an acquirer. Acquirers are subject topayment brand rules and procedures regarding merchant compliance. See Payment Processor.

Administrative
AccessElevated or increased privileges granted to an account for that account to manage systems, networks, and/or applications.
Administrative access can be assigned to an individual’s account or a built-in system account. Accounts with administrative accessare often referred to as “superuser,” “root,” “administrator,” “admin,” “sysadmin,” or “supervisor-state,” depending on the particular
operating system and organizational structure.

AES

Acronym for “Advanced Encryption Standard.” See Strong Cryptography.

ANSI

Acronym for “American National Standards Institute.”

Anti-Malware

Software that is designed to detect, and remove, block, or contain various forms of malicious software.

AOC

Acronym for “Attestation of Compliance.” The AOC is the official PCI SSC form for merchants and service providers to attest to theresults of a PCI DSS assessment, as documented in a Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC).

Application

Includes all purchased, custom, and bespoke software programs or groups of programs, including both internal and external (forexample, web) applications.

Application and
System Accounts

Also referred to as “service accounts.” Accounts that execute processes or perform tasks on a computer system or in an application.
These accounts usually have elevated privileges that are required to perform specialized tasks or functions and are not typicallyaccounts used by an individual.

ASV

Acronym for “Approved Scanning Vendor.” Company approved by the PCI SSC to conduct external vulnerability scanning services.

Audit Log

Also referred to as “audit trail.” Chronological record of system activities. Provides an independently verifiable trail sufficient to permit
reconstruction, review, and examination of sequence of environments and activities surrounding or leading to operation, procedure, or
event in a transaction from inception to final results.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 344

Term

Definition

Authentication

Process of verifying identity of an individual, device, or process. Authentication typically occurs with one or more authentication
factors. See Account, Authentication Credential, and Authentication Factor.

Authentication
Credential

Combination of the user ID or account ID plus the authentication factor(s) used to authenticate an individual, device, or process. See
Account and Authentication Factor.

Authentication Factor

The element used to prove or verify the identity of an individual or process on a computer system. Authentication typically occurs with
one or more of the following authentication factors:•

Something you know, such as a password or passphrase•

Something you have, such as a token device or smart card•
Something you are, such as a biometric element.
The ID (or account) and authentication factor together are considered authentication credentials.” See Account and Authentication
Credential.
Authorization

In the context of access control, authorization is the granting of access or other rights to a user, program, or process. Authorization
defines what an individual or program can do after successful authentication.
In the context of a payment card transaction, authorization refers to the authorization process, which completes when a merchantreceives a transaction response (for example, an approval or decline).

BAU

Acronym for “Business as Usual.”

Bespoke and Custom
SoftwareBespoke software is developed for the entity by a third party on the entity’s behalf and per the entity’s specifications.
Custom software is developed by the entity for its own use.

Card Skimmer

A physical device, often attached to a legitimate card-reading device, designed to illegitimately capture and/or store the informationfrom a payment card.

Card Verification
Code

Also referred to as Card Validation Code or Value, or Card Security Code. For PCI DSS purposes, it is the three- or four-digit value
printed on the front or back of a payment card. May be referred to as CAV2, CVC2, CVN2, CVV2, or CID according to the individual
Participating Payment Brands. For more information, contact the Participating Payment Brands.

Cardholder

Customer to which a payment card is issued to or any individual authorized to use the payment card.

Cardholder Data
(CHD)

At a minimum, cardholder data consists of the full PAN. Cardholder data may also appear in the form of the full PAN plus any of thefollowing: cardholder name, expiration date and/or service code.
See Sensitive Authentication Data for additional data elements that might be transmitted or processed (but not stored) as part of apayment transaction.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 345

Term
CDE

Definition
Acronym for “Cardholder Data Environment.” The CDE is comprised of:•

The system components, people, and processes that store, process, or transmit cardholder data or sensitive authentication data
and/or•

System components that may not store, process, or transmit CHD/SAD but have unrestricted connectivity to system componentsthat store, process, or transmit CHD/SAD.

CERT

Acronym for “Computer Emergency Response Team.”

Change Control

Processes and procedures to review, test, and approve changes to systems and software for impact before implementation.

CIS

Acronym for “Center for Internet Security.”

Cleartext Data

Unencrypted data.

Column-Level
Database Encryption

Technique or technology (either software or hardware) for encrypting contents of a specific column in a database versus the fullcontents of the entire database. Alternatively, see Disk Encryption and File-Level Encryption.

Commercial Off-theShelf (COTS)

Description of products that are stock items not specifically customized or designed for a specific customer or user and are readily
available for use.

Compensating
Controls

See PCI DSS Appendices B and C.

Compromise

Also referred to as “data compromise” or “data breach.” Intrusion into a computer system where unauthorized disclosure/theft,modification, or destruction of cardholder data is suspected.

ConsoleDirectly connected screen and/or keyboard which permits access and control of a server, mainframe computer, or other system type.
See Non-Console Access.

Consumer

Individual cardholder purchasing goods, services, or both.

Critical systems

A system or technology that is deemed by the entity to be of particular importance. For example, a critical system may be essential forthe performance of a business operation or for a security function to be maintained. Examples of critical systems often include
security systems, public-facing devices and systems, databases, and systems that store, process, or transmit cardholder data.

Cryptographic
Algorithm

Also referred to as “encryption algorithm.” A clearly specified reversible mathematical process used for transforming cleartext data to
encrypted data, and vice versa. See Strong Cryptography.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 346

Term
Cryptographic Key

Definition
A parameter used in conjunction with a cryptographic algorithm that is used for operations such as:•Transforming cleartext data into ciphertext data,•

Transforming ciphertext data into cleartext data,•

A digital signature computed from data,•

Verifying a digital signature computed from data,•

An authentication code computed from data, or•An exchange agreement of a shared secret.
See Strong Cryptography.
Cryptographic Key
Generation

Key generation is one of the functions within key management. The following documents provide recognized guidance on proper key
generation:•

NIST Special Publication 800-133: Recommendation for Cryptographic Key Generation•

ISO 11568-2 Financial services — Key management (retail) — Part 2: Symmetric ciphers, their key management and life cycle– 4.3 Key generation•

ISO 11568-4 Financial services — Key management (retail) — Part 4: Asymmetric cryptosystems — Key management and lifecycle
– 6.2 Key life cycle stages — Generation•

European Payments Council EPC 342-08 Guidelines on Algorithms Usage and Key Management– 4.1.1 Key generation [for symmetric algorithms]– 4.2.1 Key generation [for asymmetric algorithms].

Cryptographic KeyManagement

The set of processes and mechanisms which support cryptographic key establishment and maintenance, including replacing older
keys with new keys as necessary.

Cryptoperiod

The time span during which a cryptographic key can be used for its defined purpose. Often defined in terms of the period for which
the key is active and/or the amount of ciphertext that has been produced by the key, and according to industry best practices andguidelines (for example, NIST Special Publication 800-57).

Customized Approach

See PCI DSS section: 8 Approaches for Implementing and Validating PCI DSS.

CVSSAcronym for “Common Vulnerability Scoring System.” Refer to ASV Program Guide for more information.

Data-Flow Diagram

A diagram showing how data flows through an application, system, or network.

Default AccountLogin account predefined in a system, application, or device to permit initial access when system is first put into service. Additional
default accounts may also be generated by the system as part of the installation process.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 347

Term

Definition

Default Password

Password on system administration, user, or service accounts predefined in a system, application, or device; usually associated withdefault account. Default accounts and passwords are published and well known, and therefore easily guessed.

Defined Approach

See PCI DSS section: 8 Approaches for Implementing and Validating PCI DSS.

Disk Encryption

Technique or technology (either software or hardware) for encrypting all stored data on a device (for example, a hard disk or flash
drive). Alternatively, File-Level Encryption or Column-Level Database Encryption is used to encrypt contents of specific files orcolumns.

DMZ

Abbreviation for “demilitarized zone.” Physical or logical sub-network that provides an additional layer of security to an organization’s
internal private network.

DNS

Acronym for “Domain Name System.”Dual Control

Process of using two or more separate entities (usually persons) operating in concert to protect sensitive functions or information.
Both entities are equally responsible for the physical protection of materials involved in vulnerable transactions. No single person ispermitted to access or use the materials (for example, the cryptographic key). For manual key generation, conveyance, loading,storage, and retrieval, dual control requires dividing knowledge of the key among the entities. See Split Knowledge.

ECC

Acronym for “Elliptic Curve Cryptography.” See Strong Cryptography.

E-commerce (web)Redirection Server

A server that redirects a customer browser from a merchant’s website to a different location for payment processing during anecommerce transaction.

Encryption

The (reversible) transformation of data by a cryptographic algorithm to produce cipher text, i.e., to hide the information content of thedata. See Strong Cryptography.

Encryption Algorithm

See Cryptographic Algorithm.

EntityTerm used to represent the corporation, organization, or business which is undergoing a PCI DSS assessment.

File Integrity
Monitoring (FIM)

A change-detection solution that checks for changes, additions, and deletions to critical files, and notifies when such changes aredetected.

File-Level Encryption

Technique or technology (either software or hardware) for encrypting the full contents of specific files. Alternatively, see Disk
Encryption and Column-Level Database Encryption.

Firewall

Hardware and/or software technology that protects network resources from unauthorized access. A firewall permits or denies
computer traffic between networks with different security levels based upon a set of rules and other criteria.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 348

Term

Definition

Forensics

Also referred to as “computer forensics.” As it relates to information security, the application of investigative tools and analysis
techniques to gather evidence from computer resources to determine the cause of data compromises.
Investigations into compromises of payment data are typically conducted by a PCI Forensic Investigator (PFI).

FTP

Acronym for “File Transfer Protocol.” Network protocol used to transfer data from one computer to another through a public network
such as the Internet. FTP is widely viewed as an insecure protocol because passwords and file contents are sent unprotected and inclear text. FTP can be implemented securely via SSH or other technology.

Hashing

A method to protect data that converts data into a fixed-length message digest. Hashing is a one-way (mathematical) function inwhich a non-secret algorithm takes any arbitrary length message as input and produces a fixed length output (usually called a “hashcode” or “message digest”). Hash functions are required to have the following properties:•

It is computationally infeasible to determine the original input given only the hash code,•

It is computationally infeasible to find two inputs that give the same hash code.

HSM

Acronym for “hardware security module” or “host security module.” A physically and logically protected hardware device that provides
a secure set of cryptographic services, used for cryptographic key-management functions and/or the decryption of account data.

IDS

Acronym for “intrusion-detection system.”Index Token

A random value from a table of random values that corresponds to a given PAN.

Interactive Login

The process of an individual providing authentication credentials to directly log into an application or system account.

IPS

Acronym for “intrusion prevention system.”ISO

Acronym for “International Organization for Standardization.”IssuerAlso referred to as “issuing bank” or “issuing financial institution.” Entity that issues payment cards or performs, facilitates, or supports
issuing services, including but not limited to issuing banks and issuing processors.

Issuing services

Examples of issuing services include but are not limited to authorization and card personalization.

Keyed Cryptographic
Hash

A hashing function that incorporates a randomly generated secret key to provide brute force attack resistance and secretauthentication integrity.
Appropriate keyed cryptographic hashing algorithms include but are not limited to: HMAC, CMAC, and GMAC, with an effective
cryptographic strength of at least 128-bits (NIST SP 800-131Ar2).
Refer to the following for more information about HMAC, CMAC, and GMAC, respectively: NIST SP 800-107r1, NIST SP 800-38B,
and NIST SP 800-38D).
See NIST SP 800-107 (Revision 1): Recommendation for Applications Using Approved Hash Algorithms §5.3.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 349

Term

Definition

Key Custodian

A role where a person(s) is entrusted with, and responsible for, performing key management duties involving secret and/or private
keys, key shares, or key components on behalf of an entity.

Key Management
System

A combination of hardware and software that provides an integrated approach for generating, distributing, and/or managing
cryptographic keys for devices and applications.

LAN

Acronym for “local area network.”

LDAP

Acronym for “Lightweight Directory Access Protocol.”Least Privileges

The minimum level of privileges necessary to perform the roles and responsibilities of the job function.

Log

See Audit Log.

Logical AccessControl

Mechanisms that limit the availability of information or information-processing resources only to authorized persons or applications.
See Physical Access Control.

MAC

In cryptography, an acronym for “message authentication code.” See Strong Cryptography.

Magnetic-Stripe Data

See Track Data.

Masking

Method of concealing a segment of PAN when displayed or printed. Masking is used when there is no business need to view theentire PAN. Masking relates to protection of PAN when displayed on screens, paper receipts, printouts, etc.
See Truncation for protection of PAN when electronically stored, processed, or transmitted.

Media

Physical material, including but not limited to, electronic storage devices, removable electronic media, and paper reports.

Merchant

For the purposes of the PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logos of any PCI SSC
Participating Payment Brand as payment for goods and/or services.
A merchant that accepts payment cards as payment for goods and/or services can also be a service provider, if the services soldresult in storing, processing, or transmitting cardholder data on behalf of other merchants or service providers. For example, an ISP isa merchant that accepts payment cards for monthly billing, but also is a service provider if it hosts merchants as customers.

MO/TO

Acronym for “Mail-Order/Telephone-Order.”Multi-Factor
Authentication

Method of authenticating a user whereby at least two factors are verified. These factors include something the user has (such as asmart card or dongle), something the user knows (such as a password, passphrase, or PIN), or something the user is or does (suchas fingerprints and other biometric elements).

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 350

Term

Definition

Multi-Tenant Service
ProviderA type of Third-Party Service Provider that offers various shared services to merchants and other service providers, where customers
share system resources (such as physical or virtual servers), infrastructure, applications (including Software as a Service (SaaS)),
and/or databases. Services may include, but are not limited to, hosting multiple entities on a single shared server, providing ecommerce and/or “shopping cart” services, web-based hosting services, payment applications, various cloud applications andservices, and connections to payment gateways and processors. See Service Provider and Third-Party Service Provider.

NAC

Acronym for “Network Access Control.”

NAT

Acronym for “Network Address Translation.”

Network Connection

A logical, physical, or virtual communication path between devices that allows the transmission and reception of network layer
packets.

Network Diagram

A diagram showing system components and connections within a networked environment.

Network Security
Controls (NSC)

Firewalls and other network security technologies that act as network policy enforcement points. NSCs typically control network traffic
between two or more logical or physical network segments (or subnets) based on pre-defined policies or rules.

NIST

Acronym for “National Institute of Standards and Technology.” Non-regulatory federal agency within U.S. Commerce Department's
Technology Administration.

Non-Console AccessLogical access to a system component that occurs over a network interface rather than via a direct, physical connection to the systemcomponent. Non-console access includes access from within local/internal networks as well as access from external or remote
networks.

NTP

Acronym for “Network Time Protocol.”Organizational
Independence

An organizational structure that ensures there is no conflict of interest between the person or department performing the activity andthe person or department assessing the activity. For example, individuals performing assessments are organizationally separate fromthe management of the environment being assessed.

OWASP

Acronym for “Open Web Application Security Project.”

PAN

Acronym for “primary account number.” Unique payment card number (credit, debit, or prepaid cards, etc.) that identifies the issuer
and the cardholder account.

Password /Passphrase

A string of characters that serve as an authentication factor for a user or account.

Patch

Update to existing software to add function or to correct a defect.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 351

Term

Definition

Participating Payment
Brand

Also referred to as “payment brand.” A payment card brand that, as of the time in question, is then formally admitted as (or an affiliateof) a member of PCI SSC pursuant to its governing documents. At the time of writing, Participating Payment Brands include PCI SSC
Founding Members and Strategic Members.

Payment Brand

An organization with branded payment cards or other payment card form factors. Payment brands regulate where and how thepayment cards or other form factors carrying its brand or logo are used. A payment brand may be a PCI SSC Participating Payment
Brand or other global or regional payment brand, scheme, or network.

Payment Card Form
FactorIncludes physical payment cards as well as devices with functionality that emulates a payment card to initiate a payment transaction.
Examples of such devices include, but are not limited to, smartphones, smartwatches, fitness bands, key tags, and wearables such as
jewelry.

Payment Cards

For purposes of PCI DSS, any payment card form factor that bears the logo of any PCI SSC Participating Payment Brand.

Payment Channel

Methods used by merchants to accept payments from customers. Common payment channels include card present (in person) andcard not present (e-commerce and MO/TO).

Payment Page

A web-based user interface containing one or more form elements intended to capture account data from a consumer or submit
captured account data. The payment page can be rendered as any one of:•A single document or instance,•

A document or component displayed in an inline frame within a non-payment page,•

Multiple documents or components each containing one or more form elements contained in multiple inline frames within a nonpayment page.

Payment Page Scripts

Any programming language commands or instructions on a payment page that are processed and/or interpreted by a consumer’sbrowser, including commands or instructions that interact with a page’s document object model. Examples of programming languages
are JavaScript and VB script; neither markup-languages (for example, HTML) or style-rules (for example, CSS) are programming
languages.

Payment Processor

Sometimes referred to as “payment gateway” or “payment service provider (PSP).” Entity engaged by a merchant or other entity tohandle payment card transactions on their behalf. See Acquirers.

PCI DSS

Acronym for “Payment Card Industry Data Security Standard.”

Personnel

Full-time and part-time employees, temporary employees, contractors, and consultants with security responsibilities for protecting
account data or that can impact the security of account data.

Physical AccessControl

Mechanisms that limit the access to a physical space or environment to only authorized persons. See Logical Access Control.

PIN

Acronym for “personal identification number.”Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 352

Term

Definition

PIN BlockA block of data used to encapsulate a PIN during processing. The PIN block format defines the content of the PIN block and how it isprocessed to retrieve the PIN. The PIN block is composed of the PIN, the PIN length, and may contain the PAN (or a truncation
thereof) depending on the approved ISO PIN Block Format used.

POI

Acronym for “Point of Interaction,” the initial point where data is read from a card.

Point of Sale System(POS)

Hardware and software used by merchants to accept payments from customers. May include POI devices, PIN pads, electronic cash
registers, etc.

Privileged User

Any user account with greater than basic access privileges. Typically, these accounts have elevated or increased privileges with more
rights than a standard user account. However, the extent of privileges across different privileged accounts can vary greatly dependingon the organization, job function or role, and the technology in use.

QIR

Acronym for “Qualified Integrator or Reseller.” Refer to the QIR Program Guide on the PCI SSC website for more information.

QSA

Acronym for “Qualified Security Assessor.” QSAs are qualified by PCI SSC to perform PCI DSS on-site assessments. Refer to the
QSA Qualification Requirements for details about requirements for QSA Companies and Employees.

Remote Access

Access to an entity’s network from a location outside of that network. An example of technology for remote access is a VPN.

Removable Electronic
Media

Media that stores digitized data that can be easily removed and/or transported from one computer system to another. Examples ofremovable electronic media include CD-ROM, DVD-ROM, USB flash drives, and external/portable hard drives. In this context,
removable electronic media does not include hot-swappable drives, tape drives used for bulk back-ups, or other media not typicallyused to transport data from one location for use in another.

Risk Assessment

Enterprise-wide process that identifies valuable system resources and threats; quantifies loss exposures (that is, loss potential) basedon estimated frequencies and costs of occurrence; and (optionally) recommends how to allocate resources to countermeasures tominimize total exposure. See Targeted Risk Analysis.

Risk Ranking

Process of classifying risks to identify, prioritize, and address items in the order of importance.

ROC

Acronym for “Report on Compliance.” Reporting tool used to document detailed results from an entity’s PCI DSS assessment.

RSA

Algorithm for public-key encryption. See Strong Cryptography.

SAQ

Acronym for “Self-Assessment Questionnaire.” Reporting tool used to document self-assessment results from an entity’s PCI DSS
assessment.

Scoping

Process of identifying all system components, people, and processes to be included in a PCI DSS assessment. See PCI DSS section:
4 Scope of PCI DSS Requirements.

Secure Coding

The process of creating and implementing applications that are resistant to tampering and/or compromise.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 353

Term

Definition

Security Event

An occurrence considered by an organization to have potential security implications to a system or its environment. In the context of
PCI DSS, security events identify suspicious or anomalous activity.

Security Officer

Primary person responsible for an entity’s security.

Segmentation

Also referred to as “network segmentation” or “isolation.” Segmentation isolates system components that store, process, or transmit
cardholder data from systems that do not. See “Segmentation” in PCI DSS section: 4 Scope of PCI DSS Requirements.

Sensitive Area

A sensitive area is typically a subset of the CDE and is any area that houses systems considered critical to the CDE. This includes
data centers, server rooms, back-office rooms at retail locations, and any area that concentrates or aggregates cardholder data
storage, processing, or transmission. Sensitive areas also include areas housing systems that manage or maintain the security of the
CDE (for example, those providing network security controls or that manage physical or logical security).
This excludes the areas where only point-of-sale terminals are present, such as the cashier areas in a retail store or call centerswhere agents are taking payments.

Sensitive
Authentication Data
(SAD)

Security-related information used to authenticate cardholders and/or authorize payment card transactions. This information includes,
but is not limited to, card validation verification codes/values, full track data (from magnetic stripe or equivalent on a chip), PINs, andPIN blocks.

Separation of Duties

Practice of dividing steps in a function among multiple individuals, to prevent a single individual from subverting the process.

Service CodeThree-digit or four-digit value in the magnetic-stripe that follows the expiration date of the payment card on the track data. It is usedfor various things, such as defining service attributes, differentiating between international and national interchange, or identifying
usage restrictions.

Service Provider

Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalfof another entity. This includes payment gateways, payment service providers (PSPs), and independent sales organizations (ISOs).
This also includes companies that provide services that control or could impact the security of cardholder data. Examples include
managed service providers that provide managed firewalls, IDS, and other services as well as hosting providers and other entities.
If an entity provides a service that involves only the provision of public network access—such as a telecommunications company
providing just the communication link—the entity would not be considered a service provider for that service (although they may beconsidered a service provider for other services). See Multi-Tenant Service Provider and Third-Party Service Provider.

SNMP

Acronym for “Simple Network Management Protocol.”.

Split Knowledge

A method by which two or more entities separately have key components or key shares that individually convey no knowledge of theresultant cryptographic key.

SQL

Acronym for “Structured Query Language.”

SSH

Abbreviation for “Secure Shell.”Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 354

Term

Definition

SSL

Acronym for “Secure Sockets Layer.”

Strong Cryptography

Cryptography is a method to protect data through a reversible encryption process, and is a foundational primitive used in many
security protocols and services. Strong cryptography is based on industry-tested and accepted algorithms along with key lengths thatprovide a minimum of 112-bits of effective key strength and proper key-management practices.
Effective key strength can be shorter than the actual ‘bit’ length of the key, which can lead to algorithms with larger keys providing
lesser protection than algorithms with smaller actual, but larger effective, key sizes. It is recommended that all new implementations
use a minimum of 128-bits of effective key strength.
Examples of industry references on cryptographic algorithms and key lengths include:•

NIST Special Publication 800-57 Part 1,•

BSI TR-02102-1,•

ECRYPT-CSA D5.4 Algorithms, Key Size and Protocols Report (2018), and•ISO/IEC 18033 Encryption algorithms, and•ISO/IEC 14888-3:2-81 IT Security techniques – Digital signatures with appendix – Part 3: Discrete logarithm based mechanisms.

System Components

Any network devices, servers, computing devices, virtual components, or software included in or connected to the CDE, or that could
impact the security of the CDE.

System-level object

Anything on a system component that is required for its operation, including but not limited to application executables andconfiguration files, system configuration files, static and shared libraries and DLLs, system executables, device drivers and device
configuration files, and third-party components.

Targeted Risk
Analysis

For PCI DSS purposes, a risk analysis that focuses on a specific PCI DSS requirement(s) of interest, either because the requirement
allows flexibility (for example, as to frequency) or, for the Customized Approach, to explain how the entity assessed the risk anddetermined the customized control meets the objective of a PCI DSS requirement.

TDES

Acronym for “Triple Data Encryption Standard.” Also referred to as “3DES” or “Triple DES.”

TelnetAbbreviation for “telephone network protocol.”Third-Party Service
Provider (TPSP)Any third party acting as a service provider on behalf of an entity. See Multi-Tenant Service Provider and Service Provider.

Third-Party Software

Software that is acquired by, but not developed expressly for, an entity. It may be open source, freeware, shareware, or purchased.

TLS

Acronym for “Transport Layer Security.”Token

In the context of authentication and access control, a token is a value provided by hardware or software that works with anauthentication server or VPN to perform dynamic or multi-factor authentication.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 355

Term

Definition

Track Data

Also referred to as “full track data” or “magnetic-stripe data.” Data encoded in the magnetic stripe or chip used for authentication
and/or authorization during payment transactions. Can be the magnetic-stripe image on a chip or the track data on the magnetic
stripe.

Truncation

Method of rendering a full PAN unreadable by removing a segment of PAN data. Truncation relates to protection of PAN whenelectronically stored, processed, or transmitted.
See Masking for protection of PAN when displayed on screens, paper receipts, etc.

Trusted Network

Network of an entity that is within the entity’s ability to control or manage and that meets applicable PCI DSS requirements.

Untrusted Network

Any network that does not meet the definition of a “trusted network.”

Virtual Payment
Terminal

In the context of Self-Assessment Questionnaire (SAQ) C-VT, a virtual payment terminal is web-browser-based access to an acquirer,
processor, or third-party service provider website to authorize payment card transactions, where the merchant manually enters
payment card data through a web browser. Unlike physical terminals, virtual payment terminals do not read data directly from apayment card. Because payment card transactions are entered manually, virtual payment terminals are typically used instead ofphysical terminals in merchant environments with low transaction volumes.

Virtualization

The logical abstraction of computing resources from physical and/or logical constraints. One common abstraction is referred to as
virtual machines or VMs, which takes the content of a physical machine and allows it to operate on different physical hardware and/or
along with other virtual machines on the same physical hardware. Other common abstractions include, but are not limited to,containers, serverless computing, or microservices.

VPN

Acronym for “virtual private network.”

Vulnerability

Flaw or weakness which, if exploited, may result in an intentional or unintentional compromise of a system.

Web Application

An application that is generally accessed through a web browser or through web services. Web applications may be available throughthe Internet or a private, internal network.

Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0
© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

March 2022
Page 356