← All checklists
PCI DSS v4.0.1 readiness checklist
Every PCI DSS v4.0.1 requirement a merchant or service provider has to act on, mapped to its requirement number, with the evidence an assessor will ask for. Preview 18 of the 97 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers PCI DSS v4.0.1Reviewed 30 Oct 202697 items · 13 sections
Scope and approach
5 items
- Prep 1Decide whether you validate with a Self-Assessment Questionnaire (SAQ) or a Report on Compliance (ROC) with a QSA, based on your merchant level or service provider status.Evidence: Confirmation from your acquirer or card brands of the validation type and level.
Requirement 1. Network security controls
11 items
- 1.2.1Define, implement and maintain configuration standards for firewalls, security groups and other network security controls.Evidence: Approved configuration standard with last review date.
- 1.2.2Approve and test every change to network connections and network security control configurations through change control.Evidence: Change tickets with approval and test notes.
Requirement 2. Secure configurations
5 items
- 2.2.1Develop configuration standards for all system components based on industry-accepted hardening guidance.Evidence: Hardening standards mapped to CIS or vendor benchmarks.
Requirement 3. Protect stored account data
8 items
- 3.2.1Keep account data storage to a minimum with a retention policy and a process to delete data past its retention period.Evidence: Retention policy and deletion job logs.
Requirement 4. Encrypt data in transit
3 items
- 4.2.1Use strong cryptography and trusted certificates whenever PAN travels over open, public networks.Evidence: TLS configuration scan and certificate details.
Requirement 5. Protect against malware
5 items
- 5.2.1Deploy anti-malware on all system components, except those you have shown are not at risk.Evidence: Endpoint protection coverage report.
Requirement 6. Secure systems and software
11 items
- 6.2.1Develop bespoke and custom software securely, based on industry standards and secure coding practices.Evidence: Secure SDLC document.
- 6.2.2Train developers on secure coding for their languages at least once every 12 months.Evidence: Training records per developer.
Requirement 7. Restrict access by business need
4 items
- 7.2.1Define an access control model that grants access based on job function and least privilege.Evidence: Access control policy and role definitions.
Requirement 8. Identify users and authenticate access
10 items
- 8.2.1Give every user a unique ID before allowing access to system components or cardholder data.Evidence: User list from identity provider.
- 8.2.2Use shared or generic accounts only in exceptional cases, with approval and individual accountability.Evidence: Shared account register with justification.
Requirement 9. Restrict physical access
5 items
- 9.2.1Use facility entry controls to restrict physical access to systems in the CDE.Evidence: Badge access configuration or data center attestation.
Requirement 10. Log and monitor access
8 items
- 10.2.1Enable audit logs on all system components and cardholder data.Evidence: Logging configuration and SIEM source list.
Requirement 11. Test security regularly
10 items
- 11.2.1Detect authorized and unauthorized wireless access points at least once every three months.Evidence: Wireless scan reports.
- 11.3.1Run internal vulnerability scans at least once every three months and fix high-risk and critical findings.Evidence: Four quarters of internal scan reports with rescans.
Requirement 12. Policies and program
12 items
- 12.1.1Establish, publish, maintain and share an information security policy with all relevant personnel.Evidence: Published policy with acknowledgment records.
- 12.1.2Review the information security policy at least once every 12 months.Evidence: Policy review history.
Changelog
- v1.030 Oct 2026First release. Covers PCI DSS v4.0.1, including the requirements that became mandatory on 31 March 2025.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.