All 12 requirements, explained with implementation cost

01

Medium

Install and Maintain Network Security Controls

Configure and maintain firewalls and other network security controls to protect cardholder data. Includes defining traffic rules, restricting inbound/outbound access, and reviewing rule sets every six months.

Common gapsFirewall rules not reviewed semi-annually, flat network without segmentation, default configurations not changed.

4.0 changeExpanded to include all network security controls (not just firewalls). New emphasis on cloud environments.

02

Medium

Apply Secure Configurations to All System Components

Remove default passwords and unnecessary services from all systems. Apply secure configuration standards (CIS benchmarks). Manage all system components with documented configuration baselines.

Common gapsDefault credentials on devices, unnecessary services running, no documented configuration baselines.

4.0 changeRenamed from 'Do not use vendor-supplied defaults'. More explicit about inventory requirements.

03

High

Protect Stored Account Data

Minimise stored cardholder data. Encrypt stored PAN using strong cryptography. Mask PAN when displayed. Never store sensitive authentication data after authorisation.

Common gapsPAN stored in log files, full track data retained, encryption keys poorly managed, data retention policy not enforced.

4.0 changeEnhanced requirements for disk-level encryption and key management. SAD must be removed after authorisation even for issuers.

04

Low

Protect Cardholder Data with Strong Cryptography During Transmission

Encrypt cardholder data over open, public networks using strong cryptography (TLS 1.2+). Never send unprotected PAN via messaging technologies (email, SMS, chat).

Common gapsOutdated TLS versions, self-signed certificates, PAN sent in emails, internal traffic unencrypted.

4.0 changeUpdated to reference TLS 1.2 as minimum. Certificates must be valid and not expired.

05

Low

Protect All Systems and Networks from Malicious Software

Deploy anti-malware on all systems commonly affected by malware. Ensure solutions are kept current, perform periodic scans, and generate audit logs. Protect against phishing attacks.

Common gapsAnti-malware not on all in-scope systems, signatures out of date, no phishing protection.

4.0 changeAdded explicit anti-phishing requirement (5.4.1). Expanded beyond traditional anti-virus to all anti-malware.

06

High

Develop and Maintain Secure Systems and Software

Apply security patches within defined timeframes. Develop software securely. Protect web-facing applications against common attacks. Manage payment page scripts.

Common gapsPatches not applied within 30 days, no secure SDLC, payment page scripts not inventoried or monitored.

4.0 changeMajor new requirement 6.4.3: manage all payment page scripts (inventory, authorize, integrity checking). This is the most impactful 4.0 change for e-commerce.

07

Medium

Restrict Access to System Components and Cardholder Data by Business Need to Know

Limit access to cardholder data to only those personnel whose jobs require it. Implement role-based access control. Define and document access needs for each role.

Common gapsOverly broad access rights, shared accounts, access not reviewed periodically, no documented access control policy.

4.0 changeMore granular requirements for defining and documenting access needs. Application and system accounts must also be managed.

08

Medium

Identify Users and Authenticate Access to System Components

Assign unique IDs to each person. Implement strong authentication. Use multi-factor authentication for all access to the cardholder data environment. Minimum 12-character passwords.

Common gapsShared accounts, MFA not deployed for all CDE access, passwords under 12 characters, no password manager.

4.0 changeMFA required for ALL access into CDE (not just remote). Minimum password length increased from 7 to 12 characters. Password must be at least 12 characters or passphrase of at least 15.

09

Medium

Restrict Physical Access to Cardholder Data

Restrict physical access to systems and media containing cardholder data. Use video cameras or access controls at sensitive areas. Protect POS devices from tampering.

Common gapsServer room not secured, visitor logs missing, POS devices not inventoried or inspected, media not encrypted.

4.0 changeEnhanced requirements for POS device inspection and tamper detection. Targeted risk analysis for monitoring frequency.

10

High

Log and Monitor All Access to System Components and Cardholder Data

Implement audit trails for all access to cardholder data and system components. Review logs daily. Use automated log monitoring. Retain audit history for at least 12 months.

Common gapsNo centralised logging, logs not reviewed daily, insufficient log retention, no alerting on anomalies.

4.0 changeAutomated mechanisms required to detect and alert on security-relevant events. Targeted risk analysis for log review frequency.

11

High

Test Security of Systems and Networks Regularly

Conduct quarterly external ASV scans and annual penetration tests. Perform internal vulnerability scans. Use intrusion detection. Monitor for unauthorised wireless access points.

Common gapsPen test not conducted annually, ASV scans failing, no internal scanning, segmentation not tested.

4.0 changeInternal vulnerability scans must be authenticated. Segmentation testing frequency based on risk analysis. New requirement for managing all payment page scripts.

12

Medium

Support Information Security with Organisational Policies and Programs

Establish and publish a comprehensive information security policy. Conduct risk assessments annually. Implement security awareness training. Manage third-party service providers.

Common gapsPolicy not reviewed annually, no risk assessment process, training not role-specific, TPSP compliance not validated.

4.0 changeTargeted risk analysis approach (customized approach) is a major theme. TPSP management requirements strengthened. Security awareness must include phishing and social engineering.