Compliancemanzill.com
PCI DSS v4.0

Compliance assessment

PCI DSS v4.0

250 controls in 12 families. Read each control, mark it Met, Partially Met or Not Met, and keep evidence alongside. Your score is saved as you go, so you can pick up where you left off.

Start at 1.1.1

Requirement 01: Install and Maintain Network Security Controls19

1.1.1Processes and mechanisms for installing and maintaining network security controls are defined and understoodNot assessed1.1.2Processes and mechanisms for installing and maintaining network security controls are defined and understoodNot assessed1.2.1Network security controls (NSCs) are configured and maintainedNot assessed1.2.2Network security controls (NSCs) are configured and maintainedNot assessed1.2.3Network security controls (NSCs) are configured and maintainedNot assessed1.2.4Network security controls (NSCs) are configured and maintainedNot assessed1.2.5Network security controls (NSCs) are configured and maintainedNot assessed1.2.6Network security controls (NSCs) are configured and maintainedNot assessed1.2.7Network security controls (NSCs) are configured and maintainedNot assessed1.2.8Network security controls (NSCs) are configured and maintainedNot assessed1.3.1Network access to and from the cardholder data environment is restrictedNot assessed1.3.2Network access to and from the cardholder data environment is restrictedNot assessed1.4.1Network connections between trusted and untrusted networks are controlledNot assessed1.4.2Network connections between trusted and untrusted networks are controlledNot assessed1.4.3Network connections between trusted and untrusted networks are controlledNot assessed1.4.4Network connections between trusted and untrusted networks are controlledNot assessed1.4.5Network connections between trusted and untrusted networks are controlledNot assessed1.5.1Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigatedNot assessed1.3.3Network access to and from the cardholder data environment is restrictedNot assessed

Requirement 02: Apply Secure Configurations to All System Components11

2.1.1Processes and mechanisms for applying secure configurations to all system components are defined and understoodNot assessed2.1.2Processes and mechanisms for applying secure configurations to all system components are defined and understoodNot assessed2.2.1System components are configured and managed securelyNot assessed2.2.2System components are configured and managed securelyNot assessed2.2.3System components are configured and managed securelyNot assessed2.2.4System components are configured and managed securelyNot assessed2.2.5System components are configured and managed securelyNot assessed2.2.6System components are configured and managed securelyNot assessed2.2.7System components are configured and managed securelyNot assessed2.3.1Wireless environments are configured and managed securelyNot assessed2.3.2Wireless environments are configured and managed securelyNot assessed

Requirement 03: Protect Stored Account Data29

3.1.1Processes and mechanisms for protecting stored account data are defined and understoodNot assessed3.1.2Processes and mechanisms for protecting stored account data are defined and understoodNot assessed3.2.1Storage of account data is kept to a minimumNot assessed3.3.1Sensitive authentication data (SAD) is not stored after authorizationNot assessed3.3.1.1Sensitive authentication data (SAD) is not stored after authorizationNot assessed3.3.1.2Sensitive authentication data (SAD) is not stored after authorizationNot assessed3.3.1.3Sensitive authentication data (SAD) is not stored after authorizationNot assessed3.3.2Sensitive authentication data (SAD) is not stored after authorizationNot assessed3.3.3Sensitive authentication data (SAD) is not stored after authorizationNot assessed3.4.1Access to displays of full PAN and ability to copy cardholder data are restrictedNot assessed3.4.2Access to displays of full PAN and ability to copy cardholder data are restrictedNot assessed3.5.1Primary account number (PAN) is secured wherever it is storedNot assessed3.5.1.1Primary account number (PAN) is secured wherever it is storedNot assessed3.5.1.2Primary account number (PAN) is secured wherever it is storedNot assessed3.5.1.3Primary account number (PAN) is secured wherever it is storedNot assessed3.6.1Cryptographic keys used to protect stored account data are securedNot assessed3.6.1.1Cryptographic keys used to protect stored account data are securedNot assessed3.6.1.2Cryptographic keys used to protect stored account data are securedNot assessed3.6.1.3Cryptographic keys used to protect stored account data are securedNot assessed3.7.1Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implementedNot assessed3.7.3Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implementedNot assessed3.7.5Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implementedNot assessed3.7.6Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implementedNot assessed3.7.7Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implementedNot assessed3.7.8Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implementedNot assessed3.7.9Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implementedNot assessed3.6.1.4Cryptographic keys used to protect stored account data are securedNot assessed3.7.2Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implementedNot assessed3.7.4Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implementedNot assessed

Requirement 04: Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks6

4.1.1Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks are defined and documentedNot assessed4.1.2Processes and mechanisms for protecting cardholder data with strong cryptography during transmission over open, public networks are defined and documentedNot assessed4.2.1PAN is protected with strong cryptography during transmissionNot assessed4.2.1.1PAN is protected with strong cryptography during transmissionNot assessed4.2.1.2PAN is protected with strong cryptography during transmissionNot assessed4.2.2PAN is protected with strong cryptography during transmissionNot assessed

Requirement 05: Protect All Systems and Networks from Malicious Software13

5.1.1Processes and mechanisms for protecting all systems and networks from malicious software are defined and understoodNot assessed5.1.2Processes and mechanisms for protecting all systems and networks from malicious software are defined and understoodNot assessed5.2.1Malicious software (malware) is prevented, or detected and addressedNot assessed5.2.2Malicious software (malware) is prevented, or detected and addressedNot assessed5.2.3Malicious software (malware) is prevented, or detected and addressedNot assessed5.2.3.1Malicious software (malware) is prevented, or detected and addressedNot assessed5.3.1Anti-malware mechanisms and processes are active, maintained, and monitoredNot assessed5.3.2Anti-malware mechanisms and processes are active, maintained, and monitoredNot assessed5.3.2.1Anti-malware mechanisms and processes are active, maintained, and monitoredNot assessed5.3.3Anti-malware mechanisms and processes are active, maintained, and monitoredNot assessed5.3.4Anti-malware mechanisms and processes are active, maintained, and monitoredNot assessed5.4.1Anti-phishing mechanisms protect users against phishing attacksNot assessed5.3.5Anti-malware mechanisms and processes are active, maintained, and monitoredNot assessed

Requirement 06: Develop and Maintain Secure Systems and Software19

6.1.1Processes and mechanisms for developing and maintaining secure systems and software are defined and understoodNot assessed6.1.2Processes and mechanisms for developing and maintaining secure systems and software are defined and understoodNot assessed6.2.1Bespoke and custom software are developed securelyNot assessed6.2.2Bespoke and custom software are developed securelyNot assessed6.2.3Bespoke and custom software are developed securelyNot assessed6.2.3.1Bespoke and custom software are developed securelyNot assessed6.2.4Bespoke and custom software are developed securelyNot assessed6.3.1Security vulnerabilities are identified and addressedNot assessed6.3.2Security vulnerabilities are identified and addressedNot assessed6.3.3Security vulnerabilities are identified and addressedNot assessed6.4.1Public-facing web applications are protected against attacksNot assessed6.4.2Public-facing web applications are protected against attacksNot assessed6.4.3Public-facing web applications are protected against attacksNot assessed6.5.1Changes to all system components are managed securelyNot assessed6.5.2Changes to all system components are managed securelyNot assessed6.5.3Changes to all system components are managed securelyNot assessed6.5.4Changes to all system components are managed securelyNot assessed6.5.5Changes to all system components are managed securelyNot assessed6.5.6Changes to all system components are managed securelyNot assessed

Requirement 07: Restrict Access to System Components and Cardholder Data by Business Need to Know12

7.1.1Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understoodNot assessed7.1.2Processes and mechanisms for restricting access to system components and cardholder data by business need to know are defined and understoodNot assessed7.2.1Access to system components and data is appropriately defined and assignedNot assessed7.2.2Access to system components and data is appropriately defined and assignedNot assessed7.2.3Access to system components and data is appropriately defined and assignedNot assessed7.2.4Access to system components and data is appropriately defined and assignedNot assessed7.2.5Access to system components and data is appropriately defined and assignedNot assessed7.2.5.1Access to system components and data is appropriately defined and assignedNot assessed7.2.6Access to system components and data is appropriately defined and assignedNot assessed7.3.1Access to system components and data is managed via an access control system(s)Not assessed7.3.2Access to system components and data is managed via an access control system(s)Not assessed7.3.3Access to system components and data is managed via an access control system(s)Not assessed

Requirement 08: Identify Users and Authenticate Access to System Components29

8.1.1Processes and mechanisms for identifying users and authenticating access to system components are defined and understoodNot assessed8.1.2Processes and mechanisms for identifying users and authenticating access to system components are defined and understoodNot assessed8.2.1User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycleNot assessed8.2.2User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycleNot assessed8.2.3User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycleNot assessed8.2.4User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycleNot assessed8.2.5User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycleNot assessed8.2.6User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycleNot assessed8.2.7User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycleNot assessed8.2.8User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycleNot assessed8.3.1Strong authentication for users and administrators is established and managedNot assessed8.3.2Strong authentication for users and administrators is established and managedNot assessed8.3.3Strong authentication for users and administrators is established and managedNot assessed8.3.4Strong authentication for users and administrators is established and managedNot assessed8.3.5Strong authentication for users and administrators is established and managedNot assessed8.3.6Strong authentication for users and administrators is established and managedNot assessed8.3.7Strong authentication for users and administrators is established and managedNot assessed8.3.8Strong authentication for users and administrators is established and managedNot assessed8.3.9Strong authentication for users and administrators is established and managedNot assessed8.3.10Strong authentication for users and administrators is established and managedNot assessed8.3.10.1Strong authentication for users and administrators is established and managedNot assessed8.3.11Strong authentication for users and administrators is established and managedNot assessed8.4.1Multi-factor authentication (MFA) is implemented to secure access into the CDENot assessed8.4.2Multi-factor authentication (MFA) is implemented to secure access into the CDENot assessed8.4.3Multi-factor authentication (MFA) is implemented to secure access into the CDENot assessed8.5.1Multi-factor authentication (MFA) systems are configured to prevent misuseNot assessed8.6.1Use of application and system accounts and associated authentication factors is strictly managedNot assessed8.6.2Use of application and system accounts and associated authentication factors is strictly managedNot assessed8.6.3Use of application and system accounts and associated authentication factors is strictly managedNot assessed

Requirement 09: Restrict Physical Access to Cardholder Data27

9.1.1Processes and mechanisms for restricting physical access to cardholder data are defined and understoodNot assessed9.1.2Processes and mechanisms for restricting physical access to cardholder data are defined and understoodNot assessed9.2.1Physical access controls manage entry into facilities and systems containing cardholder dataNot assessed9.2.1.1Physical access controls manage entry into facilities and systems containing cardholder dataNot assessed9.2.2Physical access controls manage entry into facilities and systems containing cardholder dataNot assessed9.2.3Physical access controls manage entry into facilities and systems containing cardholder dataNot assessed9.2.4Physical access controls manage entry into facilities and systems containing cardholder dataNot assessed9.3.1.1Physical access for personnel and visitors is authorized and managedNot assessed9.3.2Physical access for personnel and visitors is authorized and managedNot assessed9.3.3Physical access for personnel and visitors is authorized and managedNot assessed9.3.4Physical access for personnel and visitors is authorized and managedNot assessed9.4.1Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.4.1.1Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.4.1.2Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.4.2Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.4.3Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.4.4Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.4.5Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.4.5.1Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.4.6Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.4.7Media with cardholder data is securely stored, accessed, distributed, and destroyedNot assessed9.5.1Point of interaction (POI) devices are protected from tampering and unauthorized substitutionNot assessed9.5.1.1Point of interaction (POI) devices are protected from tampering and unauthorized substitutionNot assessed9.5.1.2Point of interaction (POI) devices are protected from tampering and unauthorized substitutionNot assessed9.5.1.2.1Point of interaction (POI) devices are protected from tampering and unauthorized substitutionNot assessed9.5.1.3Point of interaction (POI) devices are protected from tampering and unauthorized substitutionNot assessed9.3.1Physical access for personnel and visitors is authorized and managedNot assessed

Requirement 10: Log and Monitor All Access to System Components and Cardholder Data27

10.1.1Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documentedNot assessed10.1.2Processes and mechanisms for logging and monitoring all access to system components and cardholder data are defined and documentedNot assessed10.2.1Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsNot assessed10.2.1.1Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsNot assessed10.2.1.2Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsNot assessed10.2.1.3Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsNot assessed10.2.1.4Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsNot assessed10.2.1.5Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsNot assessed10.2.1.6Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsNot assessed10.2.1.7Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsNot assessed10.2.2Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of eventsNot assessed10.3.1Audit logs are protected from destruction and unauthorized modificationsNot assessed10.3.2Audit logs are protected from destruction and unauthorized modificationsNot assessed10.3.3Audit logs are protected from destruction and unauthorized modificationsNot assessed10.3.4Audit logs are protected from destruction and unauthorized modificationsNot assessed10.4.1Audit logs are reviewed to identify anomalies or suspicious activityNot assessed10.4.1.1Audit logs are reviewed to identify anomalies or suspicious activityNot assessed10.4.2Audit logs are reviewed to identify anomalies or suspicious activityNot assessed10.4.2.1Audit logs are reviewed to identify anomalies or suspicious activityNot assessed10.4.3Audit logs are reviewed to identify anomalies or suspicious activityNot assessed10.5.1Audit log history is retained and available for analysisNot assessed10.6.1Time-synchronization mechanisms support consistent time settings across all systemsNot assessed10.6.2Time-synchronization mechanisms support consistent time settings across all systemsNot assessed10.6.3Time-synchronization mechanisms support consistent time settings across all systemsNot assessed10.7.1Failures of critical security control systems are detected, reported, and responded to promptlyNot assessed10.7.2Failures of critical security control systems are detected, reported, and responded to promptlyNot assessed10.7.3Failures of critical security control systems are detected, reported, and responded to promptlyNot assessed

Requirement 11: Test Security of Systems and Networks Regularly21

11.1.1Processes and mechanisms for regularly testing security of systems and networks are defined and understoodNot assessed11.1.2Processes and mechanisms for regularly testing security of systems and networks are defined and understoodNot assessed11.2.1Wireless access points are identified and monitored, and unauthorized wireless access points are addressedNot assessed11.2.2Wireless access points are identified and monitored, and unauthorized wireless access points are addressedNot assessed11.3.1External and internal vulnerabilities are regularly identified, prioritized, and addressedNot assessed11.3.1.1External and internal vulnerabilities are regularly identified, prioritized, and addressedNot assessed11.3.1.2External and internal vulnerabilities are regularly identified, prioritized, and addressedNot assessed11.3.1.3External and internal vulnerabilities are regularly identified, prioritized, and addressedNot assessed11.3.2External and internal vulnerabilities are regularly identified, prioritized, and addressedNot assessed11.3.2.1External and internal vulnerabilities are regularly identified, prioritized, and addressedNot assessed11.4.1External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are correctedNot assessed11.4.2External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are correctedNot assessed11.4.3External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are correctedNot assessed11.4.4External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are correctedNot assessed11.4.5External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are correctedNot assessed11.4.6External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are correctedNot assessed11.4.7External and internal penetration testing is regularly performed, and exploitable vulnerabilities and security weaknesses are correctedNot assessed11.5.1Network intrusions and unexpected file changes are detected and responded toNot assessed11.5.1.1Network intrusions and unexpected file changes are detected and responded toNot assessed11.5.2Network intrusions and unexpected file changes are detected and responded toNot assessed11.6.1Unauthorized changes on payment pages are detected and responded toNot assessed

Requirement 12: Support Information Security with Organizational Policies and Programs37

12.1.1A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and currentNot assessed12.1.2A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and currentNot assessed12.1.3A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and currentNot assessed12.2.1Acceptable use policies for end-user technologies are defined and implementedNot assessed12.3.1Risks to the cardholder data environment are formally identified, evaluated, and managedNot assessed12.3.2Risks to the cardholder data environment are formally identified, evaluated, and managedNot assessed12.3.3Risks to the cardholder data environment are formally identified, evaluated, and managedNot assessed12.3.4Risks to the cardholder data environment are formally identified, evaluated, and managedNot assessed12.4.1PCI DSS compliance is managedNot assessed12.4.2PCI DSS compliance is managedNot assessed12.4.2.1PCI DSS compliance is managedNot assessed12.5.1PCI DSS scope is documented and validatedNot assessed12.5.2PCI DSS scope is documented and validatedNot assessed12.5.2.1PCI DSS scope is documented and validatedNot assessed12.5.3PCI DSS scope is documented and validatedNot assessed12.6.1Security awareness education is an ongoing activityNot assessed12.6.2Security awareness education is an ongoing activityNot assessed12.6.3Security awareness education is an ongoing activityNot assessed12.6.3.1Security awareness education is an ongoing activityNot assessed12.6.3.2Security awareness education is an ongoing activityNot assessed12.7.1Personnel are screened to reduce risks from insider threatsNot assessed12.8.1Risk to information assets associated with third-party service provider (TPSP) relationships is managedNot assessed12.8.2Risk to information assets associated with third-party service provider (TPSP) relationships is managedNot assessed12.8.3Risk to information assets associated with third-party service provider (TPSP) relationships is managedNot assessed12.8.4Risk to information assets associated with third-party service provider (TPSP) relationships is managedNot assessed12.8.5Risk to information assets associated with third-party service provider (TPSP) relationships is managedNot assessed12.9.1Third-party service providers (TPSPs) support their customers’ PCI DSS complianceNot assessed12.9.2Third-party service providers (TPSPs) support their customers’ PCI DSS complianceNot assessed12.10.1Suspected and confirmed security incidents that could impact the CDE are responded to immediatelyNot assessed12.10.2Suspected and confirmed security incidents that could impact the CDE are responded to immediatelyNot assessed12.10.3Suspected and confirmed security incidents that could impact the CDE are responded to immediatelyNot assessed12.10.4Suspected and confirmed security incidents that could impact the CDE are responded to immediatelyNot assessed12.10.4.1Suspected and confirmed security incidents that could impact the CDE are responded to immediatelyNot assessed12.10.5Suspected and confirmed security incidents that could impact the CDE are responded to immediatelyNot assessed12.10.6Suspected and confirmed security incidents that could impact the CDE are responded to immediatelyNot assessed12.10.7Suspected and confirmed security incidents that could impact the CDE are responded to immediatelyNot assessed12.1.4A comprehensive information security policy that governs and provides direction for protection of the entity’s information assets is known and currentNot assessed