PCI DSS

What PCI DSS Requirement 11.4.5 requires for segmentation testing: how often to test, who can test, what to cover, and how 11.4.6 differs for service providers.

How to prepare for a PCI DSS v4.0.1 QSA assessment: evidence types, how the ROC Template works, organizing evidence, targeted risk analyses and vendor AOCs.

The January 2025 SAQ A drops requirements 6.4.3 and 11.6.1 and adds a script eligibility criterion. Here's what changed and what merchants should do now.

A checklist of every PCI DSS 4.0 future-dated requirement due March 31, 2025, grouped by theme and split between all entities and service providers.

PCI DSS requirement 10.4.1.1 makes automated log review mandatory on March 31, 2025. Learn what it requires, which tools fit and what evidence to keep.

PCI DSS 4.0.1 is a limited revision with no new requirements. What it clarified on patching, MFA and payment page scripts, and what stays exactly the same.

PCI DSS requirement 8.4.2 extends MFA to all access into the CDE from March 31, 2025. How it fits with 8.4.1, 8.4.3 and 8.5.1, and ways to implement it.

PCI DSS requirement 11.3.1.2 makes authenticated internal scanning mandatory from March 31, 2025. What sufficient privileges, exceptions and scan accounts mean.

How PCI DSS shared responsibility works in the cloud: provider AOCs, responsibility matrices under 12.8.5 and 12.9.2, IaaS vs. SaaS, containers, segmentation.

PCI DSS 4.0 requirements 6.4.3 and 11.6.1 cover payment page scripts and tamper detection. Learn what each requires and how to prepare before March 2025.

PCI compliance for call centers: how phone payments bring VoIP, call recordings and agent desktops into scope, and how pause-and-resume and DTMF masking differ.

PCI DSS 3.2.1 retires March 31, 2024. Learn what changes for your next assessment, what stays best practice until 2025, and how to prepare for v4.0.

PCI DSS 4.0 requirement 12.5.2 makes annual scope confirmation mandatory. Learn what it covers and how card data discovery finds PAN outside your expected CDE.

How to build a PCI responsibility matrix with your service providers, covering PCI DSS v4.0 requirements 12.8.1 to 12.8.5 and 12.9, owners and evidence.

A practical guide to the PCI DSS 4.0 targeted risk analysis: which requirements need one under 12.3.1, what it must contain, and how to do one step by step.

PCI DSS 4.0 password requirements raise the minimum to 12 characters by 2025. Here's what 8.3.6, 8.3.9, 8.3.7, 8.3.10.1 and 8.6 require and when.

A practical guide to PCI DSS Requirement 3 in version 4.0: data retention, sensitive authentication data, PAN masking, encryption, hashing and key management.

Choosing the right PCI SAQ comes down to how you take card payments. Compare the PCI DSS v4.0 SAQ types, their eligibility rules and common selection mistakes.

How point-to-point encryption (P2PE) cuts PCI scope for card-present merchants: listed solutions, SAQ P2PE, the PIM, and handling and inspecting devices.

Tokenization vs. encryption for PCI scope: why encrypted PAN usually stays in scope, when token-only systems fall out, and where P2PE fits in the picture.

ROC, SAQ and AOC explained: what each PCI compliance document is, who completes and signs it, how merchant levels apply, and where ASV scan reports fit.

How PCI DSS scoping works, which systems fall into your cardholder data environment, and how network segmentation can shrink scope and assessment effort.

ASV scans explained: what PCI DSS requires for your quarterly external scan, what counts as a pass, and how to handle scope, disputes and false positives.

The customized approach in PCI DSS 4.0 lets you meet a requirement's objective with your own control. Here's how it works, what it demands and who it suits.

PCI DSS 4.0 was published on March 31, 2022. Here's what changed from 3.2.1, which new requirements are future-dated, and how to plan your transition.