## Requirement 1 The PCI DSS v4.0 Requirement 1 focuses on installing and maintaining a network security firewall configuration to protect cardholder data. The requirement and its sub-requirements emphasize the importance of network security, particularly in safeguarding cardholder data against unauthorized access. Key aspects include: 1.1: **Documented Firewall and Router Configuration Standards** - Establishing standards that include a formal process for approving and testing all network connections and changes to firewall and router configurations. 1.2: **Restricting Connections Between Untrusted Networks and System Components in the Cardholder Data Environment (CDE)** - Implementing controls to manage connections, including a documented process for managing changes to firewall and router configurations. 1.3: **Prohibition of Direct Public Access Between the Internet and System Components in the CDE** - Ensuring that no direct routes exist between the Internet and the CDE and that direct inbound and outbound traffic is limited to necessary communications. 1.4: **A Personal Firewall for Mobile and Employee-Owned Devices** - Requiring installation and use of a personal firewall on any mobile and/or employee-owned computers with direct connectivity to the Internet when used to access the organization's network. Each of these sub-requirements entails the creation, maintenance, and regular review of various documentation, policies, and procedures to ensure effective implementation and compliance. Documentation typically includes: - Firewall and router configuration standards. - Network diagrams detailing all connections between the cardholder data environment and other networks. - Data flow diagrams showing the flow of cardholder data within the network. - Policies and procedures for managing firewall and router configurations, including change control processes. - Lists of services, protocols, and ports necessary for business, with justifications for their use. - Documentation of business justification for any available protocols apart from HTTPS, SSH, and VPN. - Records of personal firewall software approvals for employee-owned devices. Adherence to these requirements is crucial for maintaining a secure network environment and protecting cardholder data from unauthorized access and data breaches. ## Requirement 2 The documentation referenced throughout PCI DSS v4.0 Requirement 2 primarily involves the development, maintenance, and adherence to policies, procedures, and standards that ensure secure configurations for all system components within the cardholder data environment (CDE). This requirement focuses on minimizing vulnerabilities and maintaining a secure network architecture. The key sub-requirements under Requirement 2 and their associated documentation include: 2.1: **Configuration Standards for System Components** - This requires documented configuration standards for all system components. The standards should include information on secure configurations, patching, and disabling of unnecessary functionalities. 2.2: **System Component Inventories and Purpose** - Organizations need to maintain an inventory of system components in the CDE, detailing their functionalities and purposes. 2.3: **Encryption of Non-Console Administrative Access** - Policies and procedures should be in place for encrypting non-console administrative access. This includes the use of technologies such as SSH, VPN, or TLS for web-based management and other non-console administrative interfaces. 2.4: **Inventory of System Components and Documentation** - Maintaining an accurate and up-to-date inventory of system components that are in scope for PCI DSS. This documentation helps in understanding the CDE and managing the PCI DSS compliance effectively. 2.5: **Change Control Processes and Documentation** - Documented processes for tracking and monitoring all changes to system components in the CDE. This includes procedures for approving and testing changes. 2.6: **Shared Hosting Providers Must Protect Each Entity's Environment** - For shared hosting providers, policies and procedures are required to protect each entity's hosted environment and data. This includes the documentation of operational procedures for managing shared hosting environments. These documents form the backbone of an organization’s strategy for maintaining a secure and compliant cardholder data environment. They serve as guidelines for configuring systems securely, managing changes, and ensuring that every aspect of the system configuration aligns with the PCI DSS requirements. Regular reviews and updates of these documents are necessary to adapt to new threats and changes in the technology landscape. ## Requirement 3 PCI DSS v4.0 Requirement 3, which focuses on protecting stored cardholder data, includes various sub-requirements that necessitate the creation, maintenance, and review of several types of documentation. These documents are essential for ensuring the confidentiality and integrity of stored cardholder data. The key documentation referenced throughout Requirement 3 includes: - **Data Protection Policies and Procedures**: Policies and procedures for protecting stored cardholder data, including encryption, hashing, truncation, and tokenization, where applicable. - **Data Retention and Disposal Policies**: Documentation outlining the organization's procedures for retaining cardholder data only as long as necessary and securely disposing of it when no longer needed. - **Key Management Procedures**: Procedures for generating, distributing, storing, rotating, and destroying cryptographic keys used in the protection of stored cardholder data. - **Access Control Policies**: Policies and procedures for restricting access to cardholder data by business need-to-know, including the management of access permissions. - **Data Inventory and Classification**: Documentation identifying all locations and types of stored cardholder data, including an inventory of system components where this data is stored. - **Incident Response Plan**: An incident response plan outlining the actions to be taken in the event of a suspected or actual breach involving cardholder data. For each of these sub-requirements, the organization is required to maintain accurate and current documentation. Regular reviews and updates to these documents are essential to ensure that they remain effective and relevant in light of changing threats, technologies, and business practices. Adherence to these documentation requirements is crucial for maintaining the security of cardholder data and achieving compliance with PCI DSS v4.0. ## Requirement 4 PCI DSS v4.0 Requirement 4 emphasizes the secure transmission of cardholder data across open, public networks. This requirement includes various sub-requirements that necessitate specific types of documentation to ensure compliance: - **Encryption Policies and Procedures**: Policies and procedures for encrypting transmissions of cardholder data across open, public networks. This includes the use of strong cryptography and security protocols such as SSL/TLS, IPSEC, or SSH. - **Encryption Keys Management**: Documentation related to the management of cryptographic keys used for encryption of transmitted data, including key generation, distribution, storage, and destruction procedures. - **List of Trusted Keys/Certificates**: A maintained list of trusted keys and certificates ensuring that the keys and certificates are trusted and valid. - **Security Protocols Configuration Standards**: Configuration standards for implementing security protocols to safeguard transmission of cardholder data over open networks. - **End-to-End Encryption Implementation**: If end-to-end encryption is used, documentation on how it is implemented and managed. - **Security Measures for Email and File Transmissions**: Procedures for ensuring the security of cardholder data sent via email or file transfer protocols, including the use of encryption and secure protocols. - **Vendor Agreements**: If third-party service providers are used to transmit cardholder data, the documentation of agreements ensuring they adhere to PCI DSS requirements. These documents are critical for maintaining the integrity and confidentiality of cardholder data during transmission over public networks. Regular reviews and updates to these documents are essential to adapt to evolving threats and changes in technology. Compliance with these documentation requirements helps in safeguarding sensitive payment information against unauthorized interception and access during transmission. ## Requirement 5 PCI DSS v4.0 Requirement 5 centers on protecting systems against the use of malicious software. The requirement and its sub-requirements necessitate specific types of documentation to ensure compliance: 5.1.1: **Security Policies and Operational Procedures**: All security policies and operational procedures identified in Requirement 5 should be documented, kept up to date, actively used, and known to all affected parties. 5.1.2: **Roles and Responsibilities Documentation**: Documenting, assigning, and ensuring understanding of roles and responsibilities for activities related to Requirement 5. 5.2: **Malicious Software Protection**: Ensuring that anti-malware solutions are deployed on all system components, except for those identified in periodic evaluations as not at risk from malware. 5.2.3: **Documentation for Systems Not at Risk for Malware**: For system components not at risk for malware, documenting the list of such components, evaluating evolving malware threats, and confirming whether such components continue to not require anti-malware protection. 5.3: **Maintenance and Monitoring of Anti-malware Mechanisms**: Ensuring that anti-malware mechanisms are active, maintained, and monitored. This includes keeping the anti-malware solution current and performing periodic scans or continuous behavioral analysis of systems or processes. 5.3.4: **Audit Log Requirements for Anti-malware Solutions**: Ensuring that audit logs for the anti-malware solutions are enabled and retained in accordance with Requirement 10.5.1. 5.3.5: **Policy on Disabling or Altering Anti-malware Mechanisms**: Ensuring that anti-malware mechanisms cannot be disabled or altered by users unless specifically documented and authorized by management on a case-by-case basis for a limited time period. 5.4: **Anti-phishing Mechanisms**: Implementing processes and automated mechanisms to protect users against phishing attacks. This requirement is a best practice until 31 March 2025. These documents are essential for maintaining a secure environment by ensuring that the organization is effectively protecting its systems against malware and phishing attacks. Regular reviews and updates to these documents are necessary to adapt to evolving threats and changes in technology. Compliance with these documentation requirements helps in safeguarding sensitive payment information against malicious software and phishing attacks. ## Requirement 6 PCI DSS v4.0 Requirement 6 focuses on developing and maintaining secure systems and applications. The documentation referenced throughout this requirement includes a range of policies, procedures, and standards that ensure the security of system components within the cardholder data environment (CDE). The key sub-requirements under Requirement 6 and their associated documentation include: 6.1: **Security Patch Management**: This requires a documented process for timely identification and installation of critical security patches and updates for all system components. The organization should maintain records of patch installations and assessments. 6.2: **Secure Software Development Lifecycle (SDLC) Policy**: Policies and procedures for developing or modifying software in a secure manner. This includes coding standards, secure coding training, and a process for identifying and addressing security vulnerabilities in software development. 6.3: **Risk Ranking for Vulnerabilities**: A documented process for assigning a risk ranking to identified vulnerabilities. This should include criteria for ranking vulnerabilities (e.g., based on industry best practices like CVSS) and a process for prioritizing patches and mitigations based on this ranking. 6.4: **Change Control Processes and Documentation**: Documented processes for tracking and monitoring all changes to system components. This includes procedures for testing, approval, and documentation of changes. 6.5: **Security of Public-Facing Web Applications**: Policies and procedures for protecting web applications against common vulnerabilities and exposures. This may include the use of automated technical solutions (like web application firewalls) and regular code reviews. 6.6: **Application Security Testing**: Documentation outlining the methods and frequency for conducting security testing of applications. This may include penetration testing, code reviews, or the use of automated vulnerability assessment tools. For each of these sub-requirements, organizations are expected to maintain detailed documentation that outlines their processes, procedures, and standards. These documents are crucial for demonstrating compliance with the PCI DSS and for ensuring the secure development and maintenance of systems and applications within the CDE. Regular reviews and updates of these documents are essential to adapt to new threats and changes in the technology landscape. Compliance with these documentation requirements helps in safeguarding sensitive payment information. ## Requirement 7 PCI DSS v4.0 Requirement 7 focuses on restricting access to cardholder data by business need-to-know. The requirement and its sub-requirements necessitate the creation and maintenance of several types of documentation to ensure compliance: 7.1: **Access Control Policy and Procedures**: Establish, document, and disseminate the access control policy and procedures. This includes defining how access is granted, updated, and revoked. 7.1.1: **Role-Based Access Control (RBAC) System**: Implement an RBAC system that enforces access based on a user’s role and data classification. Document roles and their access privileges. 7.1.2: **Access Rights Documentation**: Document each user’s specific access rights to cardholder data, ensuring that such access is limited to the least privileges necessary to perform their job functions. 7.2: **Privileged User ID Management**: Implement procedures to manage the creation, modification, and deletion of privileged user IDs. 7.2.1: **Privileged User ID Approval**: Procedures for approving privileged user IDs, ensuring they are authorized and documented. 7.2 PCI DSS v4.0 Requirement 7, which focuses on restricting access to cardholder data based on a business need-to-know, involves various types of documentation to ensure compliance: 7.1: **Access Control Policies and Procedures** - Documentation of policies and procedures for managing access based on a user’s role and data classification. 7.1.1: **Role-Based Access Control System** - Documentation of roles and their access privileges, ensuring that access rights are aligned with job responsibilities. 7.1.2: **Access Rights Documentation** - Documentation of each user’s specific access rights to cardholder data, ensuring it is limited to the least privileges necessary to perform their job functions. 7.2: **Privileged User ID Management Procedures** - Procedures for managing the creation, modification, and deletion of privileged user IDs, including their approval process. 7.3: **Access Control Systems and Processes** - Documentation on how access control systems and processes are maintained and managed. This includes documenting changes to access control systems and procedures for monitoring and controlling all access to cardholder data. 7.4: **Access Control Measures for Critical Data** - Documenting the measures implemented to prevent unauthorized access to critical data, including access control mechanisms and monitoring. These documents play a crucial role in ensuring that access to sensitive cardholder data is appropriately managed and restricted. They also help in demonstrating compliance with PCI DSS requirements and contribute to the overall security of the cardholder data environment. Regular reviews and updates of these documents are essential to adapt to changes in the organizational structure, roles, and technology environment. ## Requirement 8 PCI DSS v4.0 Requirement 8 deals with identifying and authenticating access to system components. The documentation required throughout this requirement includes various policies, procedures, and standards to ensure secure access control: 8.1: **Identity and Access Management Policies and Procedures** - Documentation of policies and procedures for assigning unique IDs, managing user identities, and controlling access to system components. 8.1.1: **User Identification Policy** - A policy outlining how user IDs are managed, including the assignment of unique IDs to each person with access. 8.1.2: **Authentication Procedures** - Procedures for verifying the identity of users, administrators, and vendors, which may include multi-factor authentication, passwords, or biometrics. 8.2: **Guidelines for Secure Passwords and Authentication Mechanisms** - Documentation of standards for password creation, protection, and management. This includes guidelines for password length, complexity, and expiration intervals. 8.2.1: **Password Parameters** - Specific parameters for password complexity, expiration, and history to prevent reuse. 8.2.2: **Authentication Mechanisms** - Policies and procedures for authentication mechanisms other than passwords, such as tokens, biometrics, or smart cards. 8.2.3: **Multi-Factor Authentication** - Policies, procedures, and standards for implementing multi-factor authentication for remote access to the cardholder data environment and for administrators accessing sensitive areas of the system. 8.2.4: **Authentication for Non-Consumer Users and Administrators** - Procedures for authenticating non-consumer users and administrators using passwords or other authentication methods. 8.3: **Secure Remote Access** - Policies and procedures for securing remote access to the cardholder data environment, including the use of multi-factor authentication and encrypted channels. 8.4: **Cryptographic Authentication Methods** - Procedures and standards for implementing cryptographic authentication methods for non-console administrative access and remote access to the cardholder data environment. 8.5: **Group, Shared, and Generic IDs, Passwords, and Other Authentication Methods** - Policies prohibiting the use of group, shared, or generic IDs and passwords for accessing system components or cardholder data. 8.6: **Authentication for Vendor Accounts** - Procedures for managing vendor accounts, including enabling accounts only when needed and monitoring their usage. These documents are essential to ensure that access to system components is properly controlled and authenticated, thereby protecting the integrity and confidentiality of cardholder data. Regular reviews and updates of these documents are critical to maintaining robust security measures in line with evolving threats and best practices. ## Requirement 9 PCI DSS v4.0 Requirement 9 focuses on restricting physical access to cardholder data. The documentation required throughout this requirement and its sub-requirements includes various policies, procedures, and standards that ensure secure physical access controls: 9.1: **Physical Security Policies and Procedures** - Documentation of policies and procedures that define and control physical access to systems storing, processing, or transmitting cardholder data. 9.1.1: **Physical Access Controls** - Policies and procedures that manage entry into facilities and protect systems in the cardholder data environment (CDE). This includes maintaining a list of devices, periodic inspections, and training of personnel. 9.2: **Physical Entry Controls** - Documentation of measures to manage entry into facilities housing CDE systems, such as video cameras or access control mechanisms, including procedures for reviewing and retaining collected data. 9.3: **Procedures for Managing Access of Personnel and Visitors** - Documentation outlining the process of authorizing and managing physical access for both personnel and visitors, including badge systems, visitor logs, and access revocation procedures. 9.4: **Media Control Policies** - Policies and procedures for securely storing, accessing, distributing, and destroying media containing cardholder data. This includes classification of media, handling media sent outside the facility, and inventory logs. 9.5: **Protection of Point-of-Interaction (POI) Devices** - Procedures for protecting POI devices from tampering and unauthorized substitution. This involves maintaining a list of POI devices, periodic inspections, and training for personnel. These documents are critical to ensuring that physical access to systems and media containing cardholder data is appropriately restricted and monitored. Regular reviews and updates of these documents are important to maintain security and compliance with PCI DSS requirements. ## Requirement 10 PCI DSS v4.0 Requirement 10 focuses on tracking and monitoring all access to network resources and cardholder data. The required documentation throughout this requirement and its sub-requirements includes various policies, procedures, and standards for ensuring effective logging and monitoring: 10.1: **Audit Trail Policies and Procedures** - Documentation of policies and procedures for implementing an audit trail system to track all access to network resources and cardholder data. 10.2: **Automated Audit Trails** - Procedures for implementing automated audit trails for all system components to reconstruct various events. 10.3: **Audit Log Protection** - Policies and procedures for protecting audit logs from unauthorized modifications, destruction, and ensuring that read access to audit logs is limited to individuals with a job-related need. 10.4: **Audit Log Reviews** - Procedures for regular review of audit logs to identify anomalies or suspicious activity. This includes daily review of logs of all system components that store, process, or transmit CHD/SAD, critical system components, and servers performing security functions. 10.5: **Audit Log Retention** - Policies for retaining audit log history for a specific period, with at least the most recent logs readily available for analysis. 10.6: **Time Synchronization** - Procedures for time synchronization across all system components using technology such as Network Time Protocol (NTP). 10.7: **Detection and Reporting of Failures of Critical Security Control Systems** - Policies and procedures for the detection, alerting, and addressing of failures in critical security control systems. These documents are essential in ensuring effective logging and monitoring of all activities related to network resources and cardholder data, thereby maintaining the integrity and security of the cardholder data environment. Regular reviews and updates of these documents are important to address changes in technology and threats. ## Requirement 11 PCI DSS v4.0 Requirement 11 emphasizes regularly testing security systems and processes. The following policies, procedures, and standards are referenced to ensure compliance: 11.1: **Security Testing Processes and Mechanisms** - Documentation outlining processes and mechanisms for regularly testing security of systems and networks, ensuring understanding and effective implementation. 11.1.1: **Policy Documentation** - Documented policies and operational procedures related to security testing identified in Requirement 11, ensuring they are up-to-date and known to all affected parties. 11.1.2: **Roles and Responsibilities Documentation** - Documentation assigning and detailing roles and responsibilities for performing activities in Requirement 11. 11.2: **Wireless Access Point Management** - Policies for managing authorized and unauthorized wireless access points, including an inventory of authorized access points with business justification and periodic testing to detect unauthorized access points. 11.3: **Vulnerability Identification and Management** - Documentation for internal and external vulnerability scans, including procedures for conducting scans, addressing high-risk and critical vulnerabilities, and rescanning after significant changes. 11.4: **Penetration Testing Policies and Methodology** - Documentation outlining the penetration testing methodology, covering various aspects like industry-accepted approaches, testing frequency, and validation of segmentation controls. 11.5: **Intrusion Detection and Prevention** - Policies and procedures for using intrusion detection and prevention techniques to monitor and respond to intrusions, ensuring up-to-date engines, baselines, and signatures. 11.5.1: **Service Provider Specific Requirement** - For service providers, additional documentation to detect and address covert malware communication channels. 11.5.2: **Change-Detection Mechanism for Critical Files** - Policies for deploying change-detection mechanisms (e.g., file integrity monitoring tools) to alert personnel to unauthorized modifications of critical files. 11.6: **Unauthorized Change Detection on Payment Pages** - Documentation of mechanisms to detect and respond to unauthorized changes on payment pages, ensuring regular evaluation of HTTP headers and payment page contents. These documents are crucial for ensuring that security systems and processes are regularly tested and vulnerabilities are promptly addressed, maintaining the integrity and security of the cardholder data environment. Regular reviews and updates of these documents are important for adapting to evolving security challenges and maintaining compliance with PCI DSS requirements. ## Requirement 12 PCI DSS v4.0 Requirement 12 focuses on maintaining a policy that addresses information security for all personnel. The required documentation throughout this requirement and its sub-requirements includes a variety of policies, procedures, and standards: 12.1: **Information Security Policy** - Documentation of a comprehensive information security policy that governs and provides direction for protecting the entity's information assets. 12.1.1: **Security Policy Maintenance** - Policies for establishing, publishing, maintaining, and disseminating the information security policy to all relevant personnel, vendors, and business partners. 12.1.2: **Security Policy Review** - Procedures for reviewing the information security policy at least annually and updating it as needed to reflect changes in business objectives or risks. 12.1.3: **Roles and Responsibilities Definition** - Documentation clearly defining information security roles and responsibilities for all personnel, ensuring awareness and acknowledgment. 12.1.4: **Executive Management Responsibility** - Assigning responsibility for information security to a knowledgeable member of executive management, such as a Chief Information Security Officer. 12.2: **Acceptable Use Policy** - Policies defining acceptable use of end-user technologies, including explicit approval, acceptable uses of technology, and a list of approved products. 12.3: **Risk Management** - Policies and procedures for formally identifying, evaluating, and managing risks to the cardholder data environment. 12.4: **PCI DSS Compliance Management** - For service providers, documentation of a PCI DSS compliance program and executive management's responsibility PCI DSS v4.0 Requirement 12 is about maintaining a policy that addresses information security for all personnel. The documentation required throughout this requirement and its sub-requirements includes various policies, procedures, and standards: 12.1: **Information Security Policy** - A comprehensive policy that governs and provides direction for protecting the entity's information assets. 12.2: **Acceptable Use Policy** - Policies defining acceptable use of technologies, including explicit approval, acceptable uses, and a list of approved products. 12.3: **Risk Management Policies and Procedures** - Formal processes for identifying, evaluating, and managing risks to the cardholder data environment. 12.4: **PCI DSS Compliance Management (for Service Providers)** - A documented PCI DSS compliance program and executive management's responsibility. 12.5: **PCI DSS Scope Documentation and Validation** - Maintenance and confirmation of the PCI DSS scope, including inventory of system components, data flow diagrams, and segmentation controls. 12.6: **Security Awareness Program** - Formal security awareness training for personnel, including updates to address new threats and vulnerabilities. 12.7: **Personnel Screening** - Screening processes for personnel with access to the cardholder data environment. 12.8: **Third-Party Service Provider Management** - Policies and procedures for managing risks associated with third-party service providers. 12.9: **Third-Party Service Provider Compliance (for Service Providers)** - Ensuring service providers acknowledge their responsibility for securing cardholder data. 12.10: **Incident Response Plan** - A comprehensive plan for responding to security incidents, including roles, responsibilities, and procedures. 12.11: **Change Management Process** - Documented procedures for managing changes to system components. 12.12: **Information Security Critical Role Assignments** - Assigning critical security roles to specific individuals or teams. 12.13: **Data Breach Incident Response Plan** - A specific plan for responding to data breaches, including roles, responsibilities, and procedures. These documents are essential for ensuring that all personnel are aware of and understand their role in maintaining information security and that the entity is prepared to respond effectively to security incidents. Regular reviews and updates of these documents are important for adapting to changes in the security landscape and maintaining compliance with PCI DSS requirements. ## Appendix A1 PCI DSS v4.0 Appendix A1 focuses on additional requirements for multi-tenant service providers. The documentation and controls mentioned in this appendix include: - **A1.1**: Protecting and separating all customer environments and data. - **A1.1.1**: Implementing logical separation, ensuring provider access to customer environments is authorized, and customers cannot access the provider’s environment without authorization. - **A1.1.2**: Controls ensuring each customer has access only to their own cardholder data and CDE. - **A1.1.3**: Controls ensuring customers can only access resources allocated to them. - **A1.1.4**: Confirming the effectiveness of logical separation controls via penetration testing every six months. - **A1.2**: Facilitating logging and incident response for all customers. - **A1.2.1**: Enabling audit log capability for each customer’s environment consistent with PCI DSS Requirement 10. - **A1.2.2**: Implementing processes or mechanisms to support prompt forensic investigations in case of suspected or confirmed security incidents. - **A1.2.3**: Processes for reporting and addressing suspected or confirmed security incidents and vulnerabilities. These requirements emphasize the importance of maintaining distinct and secure environments for each customer of a multi-tenant service provider, along with ensuring effective logging and incident response capabilities. They require specific documentation, policies, and control mechanisms to manage these aspects effectively. Regular testing and validation of these controls are critical to ensure ongoing compliance and security. ## Appendix A2 ## Appendix A3