PCI DSS 4.0.1: Key Security Requirements Businesses Should Understand

Digital payments have become an essential part of modern business operations. From e-commerce websites and payment gateways to subscription platforms and fintech applications, organisations handle payment information across multiple systems. Protecting this data requires more than basic security controls. Businesses need a structured approach to managing vulnerabilities, restricting access, and monitoring potential threats.

The Payment Card Industry Data Security Standard (PCI DSS) provides a framework for protecting payment account data. PCI DSS 4.0.1 is a revised version of the standard that clarifies existing requirements and guidance. It does not introduce additional or remove existing requirements compared with PCI DSS 4.0.

For businesses that process, store, or transmit payment card data, understanding the PCI DSS 4.0.1 requirements is an important step towards maintaining a secure payment environment and supporting compliance efforts.

What Is PCI DSS 4.0.1?

PCI DSS is a global information security standard developed by the PCI Security Standards Council (PCI SSC). It establishes technical and operational requirements designed to protect payment account data and reduce the risk of payment card data breaches.

PCI DSS 4.0.1 was published in June 2024 to address feedback and clarify aspects of PCI DSS 4.0. The future-dated requirements introduced in PCI DSS 4.0 became effective on 31 March 2025.

The standard is relevant to organisations involved in payment card processing, including merchants, payment service providers, and other entities whose systems fall within the applicable assessment scope.

PCI DSS compliance involves implementing appropriate security controls, maintaining supporting evidence, and validating that the relevant requirements are met. The specific validation process depends on the organisation's role, payment environment, and applicable compliance programme.

Key PCI DSS 4.0.1 Security Requirements

PCI DSS contains 12 principal requirements organised around protecting networks, securing systems, controlling access, and maintaining security processes. The following areas deserve particular attention.

1. Install and Maintain Network Security Controls

Businesses must establish and maintain network security controls to protect the systems that store, process, or transmit payment account data.

Poorly configured firewalls, unnecessary open ports, and unrestricted connections between internal systems can expose sensitive payment environments to attacks.

Organisations should review network configurations, restrict unnecessary traffic, document permitted connections, and reassess controls when significant infrastructure changes occur.

Practical example: An e-commerce business may operate payment systems alongside its corporate network. Appropriate network segmentation and access restrictions can help limit unnecessary communication between these environments.

2. Protect Stored Account Data

Protecting stored payment account data is a central part of PCI DSS compliance. Organisations should understand what account data they retain, where it is stored, and why it is necessary.

Important measures include minimising data retention, protecting stored account data using applicable security mechanisms, and managing cryptographic keys securely.

Sensitive authentication data, such as card verification codes, must not be stored after authorisation, even if encrypted, subject to the standard's applicable provisions.

Businesses should also review databases, application logs, backups, and exported reports to identify unintended storage of payment information.

3. Protect Account Data During Transmission

Payment information transmitted across open, public networks must be protected using strong cryptography and secure configurations.

Outdated protocols, weak encryption settings, and improperly configured certificates can create opportunities for attackers to intercept sensitive information.

Organisations should verify that secure communication protocols are configured appropriately, certificates are managed correctly, and insecure transmission methods are disabled where required.

For online payment platforms, these controls help protect payment information as it moves between customers, applications, payment gateways, and other systems.

4. Protect Systems Against Malicious Software

Malware can compromise payment environments, steal sensitive information, or disrupt business operations. PCI DSS requires organisations to implement appropriate measures to protect systems against malicious software.

Businesses should deploy suitable anti-malware or other applicable protective mechanisms, keep them updated, and monitor systems for suspicious activity.

Security teams should also consider how malware could enter the environment through phishing emails, compromised endpoints, vulnerable applications, or unauthorised software.

For example, an employee opening a malicious attachment could expose a workstation that has access to payment-related systems. Endpoint protection, access restrictions, and security monitoring can help reduce the potential impact.

5. Develop and Maintain Secure Systems and Software

Vulnerabilities in applications, operating systems, and supporting infrastructure can provide attackers with opportunities to compromise payment data.

PCI DSS requires organisations to maintain secure systems, identify vulnerabilities, apply relevant security patches, and follow secure development practices where applicable.

Businesses should establish a vulnerability management process that includes:

• Identifying known vulnerabilities in systems and software.
• Evaluating risk and prioritising remediation.
• Applying relevant security patches and updates.
• Testing applications for security weaknesses.
• Reviewing payment-page scripts and their integrity where the applicable requirements demand it.

Vulnerability Assessment and Penetration Testing (VAPT) can support this process by helping organisations identify weaknesses in applications, networks, and infrastructure. Testing should be planned according to the applicable PCI DSS requirements and the organisation's assessment scope.

6. Implement Strong Access Control Measures

Access to payment environments should be restricted to authorised users based on business need.

Excessive privileges, shared accounts, weak passwords, and poorly managed employee access can increase the risk of unauthorised activity.

Organisations should assign unique user IDs, follow the principle of least privilege, review access rights regularly, and remove access when it is no longer required.

PCI DSS 4.0 also expanded multi-factor authentication requirements. Applicable access to the cardholder data environment must be protected by MFA, subject to the standard's specific provisions and exceptions.

Regular access reviews help businesses identify unnecessary permissions and reduce the risk of compromised accounts being used to access sensitive systems.

7. Restrict Physical Access to Payment Data

Payment security extends beyond digital systems. Unauthorised physical access to servers, workstations, storage media, and printed records can also expose sensitive information.

Businesses should restrict access to facilities containing relevant systems, monitor physical entry where required, and maintain controls over devices and media that contain account data.

For example, an unattended workstation connected to a payment environment or an improperly discarded document containing cardholder data can create avoidable security risks.

Physical security measures should be appropriate to the environment and aligned with the applicable PCI DSS requirements.

8. Log and Monitor Access to Systems

System logs provide valuable evidence when investigating suspicious activity, unauthorised access, and potential security incidents.

PCI DSS requires organisations to implement logging and monitoring controls for relevant systems and access to account data. Logs should be protected against unauthorised modification and reviewed according to applicable requirements.

Security teams should monitor unusual login activity, unexpected privilege changes, suspicious system events, and other indicators of potential compromise.

Centralised logging and security monitoring can help organisations correlate events across multiple systems. A Security Operations Centre (SOC) can support these activities by monitoring alerts, investigating suspicious behaviour, and assisting with incident escalation.

Logging alone is not sufficient. Businesses also need documented review procedures and a clear process for investigating and responding to potential threats.

9. Test Security Systems and Processes Regularly

Security controls can become ineffective as applications, networks, and business processes change. Regular testing helps organisations identify weaknesses before attackers can exploit them.

PCI DSS includes requirements relating to vulnerability scanning, penetration testing, intrusion detection or prevention mechanisms, and monitoring for unauthorised changes, as applicable.

Businesses should understand the difference between these activities:

• Vulnerability scanning: Identifies known vulnerabilities and potential weaknesses.
• Penetration testing: Evaluates whether security weaknesses can be exploited within an authorised test scope.
• Configuration reviews: Assess whether systems and security controls are configured appropriately.
• Security monitoring: Helps identify suspicious activity and potential changes that require investigation.

PCI DSS defines specific testing frequencies and conditions. For example, applicable external vulnerability scans must be performed by a PCI Approved Scanning Vendor (ASV) at least once every three months.

Penetration testing and other assessments must follow the applicable requirements rather than relying on a generic annual security review alone.

10. Maintain an Information Security Policy

Technology controls are most effective when supported by clear policies, defined responsibilities, and consistent procedures.

PCI DSS requires organisations to maintain an information security policy and supporting processes appropriate to their environment.

Policies should address relevant areas such as access management, acceptable technology use, vulnerability handling, incident response, employee responsibilities, and third-party service provider management.

Employees should understand their security responsibilities, and organisations should review policies periodically and when significant changes occur.

A documented policy is only one part of compliance. Businesses must also implement the required controls and maintain evidence that they operate effectively.

Important PCI DSS 4.0.1 Changes Businesses Should Know

Although PCI DSS 4.0.1 did not add or remove requirements compared with PCI DSS 4.0, the wider transition to version 4.0 introduced important changes to the standard.

Key areas include:

• Expanded MFA requirements: Stronger authentication expectations for applicable access to the cardholder data environment.
• Payment-page security: Requirements addressing payment-page scripts and detection of unauthorised changes, where applicable.
• Targeted risk analysis: Certain requirements allow activity frequencies to be determined through a documented risk analysis.
• Greater flexibility: The customised approach allows eligible organisations to demonstrate that their controls meet defined security objectives, subject to the standard's conditions.
• Continuous security: Greater emphasis on ongoing risk management, monitoring, testing, and maintaining effective controls.

Organisations should refer to the official PCI DSS 4.0.1 standard and applicable supporting guidance to determine which requirements apply to their environment.

How VAPT Supports PCI DSS Compliance

Vulnerability Assessment and Penetration Testing can help organisations evaluate the security of systems within their payment environment.

A VAPT engagement may identify issues such as insecure application configurations, exposed services, weak access controls, vulnerable software, or weaknesses in network segmentation.

For businesses preparing for a PCI DSS assessment, security testing can help reveal gaps that require remediation and provide useful technical evidence for the compliance process.

A practical approach includes:

1. Define the scope: Identify the systems, applications, networks, and components relevant to the cardholder data environment.
2. Assess vulnerabilities: Review systems for known weaknesses and configuration issues.
3. Conduct penetration testing: Evaluate exploitable weaknesses within an authorised scope.
4. Prioritise remediation: Address findings according to severity, exposure, and business impact.
5. Retest where appropriate: Verify that identified issues have been resolved.
6. Maintain evidence: Keep assessment reports, remediation records, and other relevant documentation.

VAPT supports security validation but does not, by itself, establish PCI DSS compliance. Organisations must meet all applicable requirements and complete the appropriate validation process.

A Practical PCI DSS Compliance Checklist

Businesses can use the following checklist as an initial review of their payment security practices.

• Identify systems that store, process, or transmit payment account data.
• Review network security controls and segmentation.
• Minimise stored account data and protect retained information.
• Verify encryption and secure transmission configurations.
• Maintain malware protection and secure system configurations.
• Apply security patches and manage application vulnerabilities.
• Enforce appropriate access restrictions and MFA.
• Review physical security and media-handling procedures.
• Maintain logs, monitor suspicious activity, and investigate alerts.
• Schedule applicable vulnerability scans and penetration tests.
• Review third-party service providers and shared security responsibilities.
• Maintain security policies, assessment evidence, and remediation records.

This checklist is a starting point rather than a complete compliance assessment. The applicable PCI DSS requirements depend on the organisation's environment and validation method.

Conclusion

PCI DSS 4.0.1 reinforces the importance of protecting payment account data through effective technical controls, secure application development, restricted access, continuous monitoring, and regular security testing.

Businesses should treat PCI DSS compliance as an ongoing security responsibility rather than a documentation exercise. Understanding the applicable requirements, identifying security gaps, and validating remediation can help organisations maintain a more resilient payment environment.

A structured security assessment, supported by vulnerability management and penetration testing, can help businesses understand their exposure and prioritise improvements. When combined with effective operational controls and appropriate compliance validation, these activities contribute to stronger payment security.

For organisations reviewing their payment environment, a VAPT service in India can provide technical insight into potential vulnerabilities and help inform a risk-based remediation plan.