The 12 PCI DSS Requirements

PCI DSS v4.0 is built on 12 requirements grouped under six goals. Each requirement below opens a full breakdown: sub-requirements, how to meet them, tips, a worked example, and the evidence to keep.

PCI DSS cardholder data flow showing checkout, gateway, token, logs and cardholder data environment boundary. — PCI cardholder flow / 12 KB WebP

Build and maintain a secure network and systems

Requirement 1

Install and maintain network security controls

Requirement 2

Apply secure configurations to all system components

Protect account data

Requirement 3

Protect stored account data

Requirement 4

Protect cardholder data with strong cryptography during transmission over open, public networks

Maintain a vulnerability management program

Requirement 5

Protect all systems and networks from malicious software

Requirement 6

Develop and maintain secure systems and software

Implement strong access control measures

Requirement 7

Restrict access to system components and cardholder data by business need to know

Requirement 8

Identify users and authenticate access to system components

Requirement 9

Restrict physical access to cardholder data

Regularly monitor and test networks

Requirement 10

Log and monitor all access to system components and cardholder data

Requirement 11

Test security of systems and networks regularly

Maintain an information security policy

Requirement 12

Support information security with organisational policies and programs

Get the documents in our PCI DSS templates (data-flow inventory, scope, SAQ guide, and more).

Audit-ready next steps

PCI DSS documents, evidence, and software path

Cardholder data flow, scope, SAQ, TPSP responsibility, access, logging, crypto, and incident records.

Templates Readiness Control map Software

Open full policy pack ->Open readiness checklist ->