Getting Started with PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for any organization that stores, processes, or transmits cardholder data. PCI DSS v4.0 is the current version, with the transition period from v3.2.1 completed on March 31, 2024. Additional future-dated requirements in v4.0 become mandatory on March 31, 2025. PCI DSS is maintained by the PCI Security Standards Council and enforced through the payment card brands (Visa, Mastercard, American Express, Discover, JCB). Compliance is validated through Self-Assessment Questionnaires (SAQs) or on-site assessments by a Qualified Security Assessor (QSA), depending on your transaction volume and merchant level. Matproof maps PCI DSS v4.0 requirements to controls, policies, and evidence workflows so you can prepare for your annual assessment.

Activate PCI DSS under Settings - Frameworks - PCI DSS. Controls are pre-populated across all 12 requirements and their sub-requirements.

Am I in Scope?

PCI DSS applies to any entity that stores, processes, or transmits cardholder data or sensitive authentication data, including:

Merchants (online and physical)
Payment processors and acquirers
Issuers
Service providers that handle cardholder data on behalf of other entities

Reduce your scope by minimizing where cardholder data is stored and processed. Using a PCI-compliant payment processor (like Stripe or Adyen) that tokenizes card data can significantly reduce the number of applicable requirements.

The 12 PCI DSS Requirements

PCI DSS is organized into six goals and 12 requirements:

Goal	Requirement	Matproof Module
Build and Maintain a Secure Network	1. Install and maintain network security controls	Controls
	2. Apply secure configurations to all system components	Controls
Protect Account Data	3. Protect stored account data	Controls, Evidence
	4. Protect cardholder data with strong cryptography during transmission	Controls
Maintain a Vulnerability Management Program	5. Protect all systems and networks from malicious software	Controls
	6. Develop and maintain secure systems and software	Controls, Policies
Implement Strong Access Control Measures	7. Restrict access to system components and cardholder data by business need to know	Controls, People
	8. Identify users and authenticate access to system components	Controls
	9. Restrict physical access to cardholder data	Controls
Regularly Monitor and Test Networks	10. Log and monitor all access to system components and cardholder data	Controls, Evidence
	11. Test security of systems and networks regularly	Controls, Cloud Tests
Maintain an Information Security Policy	12. Support information security with organizational policies and programs	Policies, People

PCI DSS v4.0 Key Changes

If you were compliant with v3.2.1, these are the most significant changes in v4.0:

Change	Impact
Customized approach	Organizations can now meet requirements using alternative controls with a customized validation approach, in addition to the traditional defined approach
Targeted risk analysis	Required for certain requirements where frequency or scope is determined by the entity
Enhanced authentication	Multi-factor authentication required for all access to the cardholder data environment (not just remote access)
Automated technical controls	Greater emphasis on automated mechanisms for detection and response
Security awareness	Enhanced training requirements including phishing awareness

Recommended Implementation Plan

Merchant Levels

Level	Transaction Volume (Visa)	Validation
1	Over 6 million transactions per year	Annual on-site QSA assessment + quarterly ASV scan
2	1-6 million transactions per year	Annual SAQ + quarterly ASV scan
3	20,000 - 1 million e-commerce transactions per year	Annual SAQ + quarterly ASV scan
4	Fewer than 20,000 e-commerce or up to 1 million other transactions per year	Annual SAQ + quarterly ASV scan (recommended)

Merchant levels and validation requirements vary by card brand. The table above reflects Visa’s classification. Check with your acquiring bank for your specific obligations.

Next Steps

Controls - working through PCI DSS requirement controls
Evidence Collection - automated evidence from integrations
Cloud Tests - vulnerability scanning and penetration testing evidence
Vendor Risk - service provider compliance management

EU Regulations

German Regulations

International Standards

Industry-Specific

Getting Started with PCI DSS

Getting Started with PCI DSS

Am I in Scope?

The 12 PCI DSS Requirements

PCI DSS v4.0 Key Changes

Recommended Implementation Plan

Merchant Levels

Next Steps

​Getting Started with PCI DSS

​Am I in Scope?

​The 12 PCI DSS Requirements

​PCI DSS v4.0 Key Changes

​Recommended Implementation Plan

​Merchant Levels

​Next Steps

Getting Started with PCI DSS

Am I in Scope?

The 12 PCI DSS Requirements

PCI DSS v4.0 Key Changes

Recommended Implementation Plan

Merchant Levels

Next Steps