Skip to main content

​
PCI DSS v4.0

The Payment Card Industry Data Security Standard (PCI DSS) is published and maintained by the PCI Security Standards Council, a body founded by the major card brands (Visa, Mastercard, American Express, Discover, and JCB). It defines the security requirements that any organization must meet if it processes, stores, or transmits payment card data — regardless of company size, transaction volume, or industry. Version 4.0 is the current release, representing the most significant revision to PCI DSS in over a decade. It introduces a customized approach that allows mature organizations to achieve requirements through alternative controls with documented validation, adds new requirements targeting phishing and e-commerce security, and expands multi-factor authentication requirements across the cardholder data environment. Compliance with PCI DSS v4.0 became mandatory in March 2024. Non-compliance carries significant consequences: fines from acquiring banks, increased transaction fees, mandatory forensic investigations following a breach, and potential loss of card acceptance privileges. Ayliea’s 124-question assessment covers all 12 PCI DSS requirements across the six control objectives, helping you identify gaps before a formal Qualified Security Assessor (QSA) engagement.

​
What Ayliea Assesses

The assessment maps to the six PCI DSS control objectives and 12 requirements within them.
Network security controls protecting the cardholder data environment (CDE). Evaluates firewall configuration, network segmentation, documentation of allowed traffic flows, and whether default vendor passwords and security settings have been changed on all system components.
How your organization stores and transmits cardholder data. Covers data retention and disposal policies, encryption of stored primary account numbers (PAN), masking on displays, and encryption of cardholder data transmitted over open, public networks. Includes key management practices.
Malware protection across system components, vulnerability management processes, and secure software development practices. Evaluates scanning frequency, patch management SLAs, and software security controls including protection against common web application vulnerabilities.
Restricting access to cardholder data on a need-to-know basis. Covers logical access controls, unique user IDs and authentication requirements (including the expanded MFA requirements in v4.0), and physical access controls for facilities and systems in the cardholder data environment.
Logging and monitoring of all access to network resources and cardholder data, audit log protection and review procedures, and regular testing of security systems and processes — including internal and external vulnerability scanning, penetration testing, and intrusion detection coverage.
The policy and governance foundation of your PCI DSS program. Evaluates your information security policy coverage and annual review process, risk assessments, security awareness training, incident response plan, and third-party service provider management including contractual requirements and annual acknowledgment of responsibility.

​
Who Needs This Assessment

  • E-commerce companies that accept card payments on their websites or applications
  • Retail and hospitality organizations with point-of-sale systems
  • Payment processors, payment gateways, and acquiring banks
  • SaaS companies that integrate with payment systems on behalf of their customers
  • Organizations that store card data for recurring billing or subscription management
  • Companies preparing for an annual QSA assessment or Self-Assessment Questionnaire (SAQ)
  • Organizations that have experienced a payment card breach and are implementing remediation requirements
PCI DSS applicability and the level of assessment required (QSA audit vs. SAQ) depends on your annual transaction volume and card brand agreements. Consult your acquiring bank or a QSA to determine which compliance path applies to your organization. Ayliea’s assessment is a gap analysis tool and does not replace a formal QSA engagement.

​
Getting Started

The PCI DSS v4.0 assessment requires an Organization subscription. Select PCI DSS from the framework list in the Assess tab. The six control objective structure makes it natural to assign sections to your network, application security, and GRC teams. For step-by-step instructions, see the Quickstart guide.