The 12 PCI DSS v4.0.1 Requirements Explained (with Sub-Requirements)

PCI DSS v4.0.1 organizes roughly 286 testing procedures under 12 requirements and six control objectives. This hub summarizes each requirement's official title and primary focus, then links to CyberSilo deep-dive guides. For the full framework overview, start at the PCI DSS hub.

Regional note for Saudi / GCC merchants: see also PCI DSS 12 requirements explained for Saudi merchants.

Official framing: Clause titles below match PCI DSS v4.0 / v4.0.1. The v4.0.1 limited revision clarified wording and guidance; it did not add or delete requirements. Many former future-dated controls became mandatory on 31 March 2025.

Six Control Objectives

Build and Maintain a Secure Network and Systems - Requirements 1 and 2
Protect Account Data - Requirements 3 and 4
Maintain a Vulnerability Management Program - Requirements 5 and 6
Implement Strong Access Control Measures - Requirements 7, 8, and 9
Regularly Monitor and Test Networks - Requirements 10 and 11
Maintain an Information Security Policy - Requirement 12

All 12 Requirements

Install and Maintain Network Security Controls

NSCs, diagrams, six-month rule reviews.

Apply Secure Configurations to All System Components

Harden components, change vendor defaults.

Protect Stored Account Data

Minimize storage, never keep SAD post-auth, render PAN unreadable.

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

Strong crypto for PAN on open public networks.

Protect All Systems and Networks from Malicious Software

Anti-malware and phishing technical controls (5.4.1).

Develop and Maintain Secure Systems and Software

Secure SDLC, patching, payment page scripts (6.4.3).

Restrict Access to System Components and Cardholder Data by Business Need to Know

Least privilege and access reviews (7.2.4 / 7.2.5).

Identify Users and Authenticate Access to System Components

Unique IDs, 12-character passwords (8.3.6), MFA (8.4.2).

Restrict Physical Access to Cardholder Data

Physical access, media, and POI device controls (9.5.1).

Log and Monitor All Access to System Components and Cardholder Data

Daily review (10.4.1), automation (10.4.1.1), retention (10.5.1), time sync (10.6).

Test Security of Systems and Networks Regularly

ASV scans, pentests, IDS/FIM, payment-page tamper detection (11.6.1).

Support Information Security with Organizational Policies and Programs

Policy, TRA (12.3.1), awareness, TPSPs, incident response.

Map PCI DSS v4.0.1 Controls to Continuous Evidence

CyberSilo CSA and ThreatHawk SIEM help US merchants and service providers collect QSA-ready evidence across the 12 requirements.

Request a PCI Gap Scan Explore Compliance Automation

Frequently Asked Questions

How many requirements does PCI DSS v4.0.1 have?

PCI DSS v4.0.1 still has 12 principal requirements. The limited revision clarified wording and guidance; it did not add or delete requirements.

What changed for future-dated controls?

Many v4.0 controls that were best practices until 31 March 2025 are now mandatory. Full verified ID list: 51 future-dated requirements. Related: TRA elements, Customized Approach, and PCI DSS v4.0.1 overview.

What is the difference between an SAQ and a ROC?

Eligible merchants and service providers may validate with a Self-Assessment Questionnaire (SAQ). Level 1 entities typically require a Report on Compliance (ROC) by a Qualified Security Assessor. See the SAQ vs ROC guide and the main PCI DSS hub for assessment paths.

PCI DSS hub · Gap assessment · Future-dated requirements · Customized Approach · TRA required elements · Evidence checklist · Checklist · IR plan template · SAQ selector · PCI DSS v4.0.1: What Changed · SAQ vs ROC

The 12 PCI DSS v4.0.1 Requirements Explained (with Sub-Requirements)

Six Control Objectives

All 12 Requirements

Install and Maintain Network Security Controls

Apply Secure Configurations to All System Components

Protect Stored Account Data

Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

Protect All Systems and Networks from Malicious Software

Develop and Maintain Secure Systems and Software

Restrict Access to System Components and Cardholder Data by Business Need to Know

Identify Users and Authenticate Access to System Components

Restrict Physical Access to Cardholder Data

Log and Monitor All Access to System Components and Cardholder Data

Test Security of Systems and Networks Regularly

Support Information Security with Organizational Policies and Programs

Map PCI DSS v4.0.1 Controls to Continuous Evidence

Frequently Asked Questions

How many requirements does PCI DSS v4.0.1 have?

What changed for future-dated controls?

What is the difference between an SAQ and a ROC?

Latest Articles

US State Privacy Laws (redirects to 2026 evergreen hub)

What Is FedRAMP? Authorization Explained for Cloud Service Providers

GDPR Breach Notification: Articles 33 and 34 (72-Hour Guide)

How Much Does ISO 27001 Certification Cost in 2026? (US, EU, GCC, Pakistan)

ISO 27001 Certification in Pakistan, UAE and Saudi Arabia: Process and Cost

How to Define ISO 27001 ISMS Scope (with Examples)

The 12 PCI DSS v4.0.1 Requirements Explained (with Sub-Requirements)

Six Control Objectives

All 12 Requirements

Map PCI DSS v4.0.1 Controls to Continuous Evidence

Frequently Asked Questions

How many requirements does PCI DSS v4.0.1 have?

What changed for future-dated controls?

What is the difference between an SAQ and a ROC?

Related PCI Resources

Latest Articles

US State Privacy Laws (redirects to 2026 evergreen hub)

What Is FedRAMP? Authorization Explained for Cloud Service Providers

GDPR Breach Notification: Articles 33 and 34 (72-Hour Guide)

How Much Does ISO 27001 Certification Cost in 2026? (US, EU, GCC, Pakistan)

ISO 27001 Certification in Pakistan, UAE and Saudi Arabia: Process and Cost

How to Define ISO 27001 ISMS Scope (with Examples)