# Complete PCI DSS Compliance Checklist: Navigate the 12 Requirements of PCI DSS 4.0

> Ensure your business is following all 12 PCI DSS 4.0 requirements with our interactive compliance checklist consisting of key policy, process, and implementation steps.

canonical: https://secureframe.com/blog/pci-compliance-checklist

A quick scan of the PCI DSS’s 300+ controls, 12 requirements, and six control objectives will make one thing abundantly clear: PCI compliance is no walk in the park. 

To make the process a little easier, we’ve created a checklist that goes through each of the 12 requirements and highlights key policy, process, and implementation steps. 

Our checklist will help you tick off as many of these to-dos as possible before you begin the formal [PCI DSS compliance](https://secureframe.com/blog/how-to-become-pci-compliant) process. 

Let’s dive in.

## What’s PCI compliance?

## Quick review: What’s PCI compliance?

PCI DSS, which stands for Payment Card Industry Data Security Standard, is mandated by major credit card companies to standardize the protection of account data. PCI provides clear guidelines for how to capture, process, and store this sensitive data.  

PCI compliance is required for any company that processes, stores, transmits, or impacts the security of cardholder data and/or sensitive authentication data.

There are different compliance levels that correspond with how many card transactions you handle over the course of a year or simply based on risk. The more card transactions you process or the higher your risk level, the more rigorous your [PCI compliance audit process](https://secureframe.com/blog/pci-audit) will be. 

Non-compliance may result in fines and penalties, increased likelihood of data breaches, and loss of merchant license or ability to work with payment processors.

The PCI Security Standards Council (PCI SSC) creates and updates the PCI DSS standard as part of a continuous effort to encourage and enhance payment account data security and facilitate the broad adoption of consistent data security measures globally. [PCI v4.0.1](https://secureframe.com/blog/pci-dss-4.0.1) is the latest version of the standard.

## The Ultimate Guide to PCI DSS

Learn everything you need to know about the requirements, process, and costs of getting PCI certified.

## 4 key steps to adhering to PCI DSS

## 4 key steps to adhering to PCI DSS

PCI DSS compliance is a continuous process that can be broken down into a series of ongoing steps:

1. **Gap assessment** **— **Using the PCI DSS prioritized approach tool, Secureframe platform, or a consultant — or a combination of all three — identify the scope of your PCI DSS environment and assessment, inventory all account data storage locations, software and infrastructure, and begin reviewing your implementation of PCI DSS requirements and objectives.
2. **Audit — **If your organization requires a third-party audit by a QSA, scheduling and preparing for an audit would be your next step. Secureframe has a [qualified partner list](https://secureframe.com/hub/pci-dss/qsa) and can help introduce you to partners if your organization has not engaged with a QSA firm.  
3. **Remediate — **Fix any identified vulnerabilities or non-conformities from the audit and gap assessment phase. This may involve patching software, updating firewall rules, securely removing any unnecessary account data storage, or implementing secure business processes.
4. **Report — **The auditor will then draft a report on compliance or, if you are self attesting, you will use the template on the PCI SSC website to attest to your own PCI DSS compliance.  You can then use an attestation of compliance to share your PCI DSS compliance to customers or requesting agencies.

Complying with PCI DSS’s technical and operational requirements can help mitigate  vulnerabilities and protect cardholder data and/or sensitive authentication data wherever it is processed, stored or transmitted. Let’s dive into these requirements below.

## The 12 PCI DSS requirements

## The 12 PCI DSS requirements

The PCI DSS standard includes 6 objectives and 12 principal requirements with sub requirements specifically stating which controls need to be in place. The requirements are a mix  of technical and operational controls designed to protect account data.

Each PCI compliance requirement maps to one of six specific objectives, which are:

Each requirement maps to one of six specific PCI DSS goals, which are:

1. Build and maintain a secure network
2. Protect cardholder data
3. Maintain a vulnerability management program
4. Implement strong access control measures
5. Regularly monitor and test networks
6. Maintain an information security policy

. The objectives and requirements are listed in the image below.

![](https://images.prismic.io/secureframe-com/Zqf5Xh5LeNNTxk5O_12PrincipalPCIDSSrequirements.png?auto=format,compress)

When a business can attest that all requirements that are applicable to their environment  are met, they are considered PCI compliant.

Below is a brief overview of each requirement.

### 1. Install and Maintain Network Security Controls 

Organizations must establish and maintain network security controls (NSCs) to control traffic within their network — the cardholder data environment (CDE) in particular— and to protect their systems and data from exposure to untrusted networks like the Internet. Previously, organizations mostly relied on physical firewalls to prevent unauthorized access. Now, they use virtual devices, cloud access controls, virtualization/container systems, routers configured with access control lists, and other software-defined networking technology in addition to firewalls.

### 2. Apply Secure Configurations to All System Components

Since malicious individuals often use default passwords and other vendor default settings to compromise systems, organizations must apply secure configurations to all system components to reduce the risk that these individuals pose. This means:

- changing default passwords
- removing unnecessary software, functions, and accounts
- disabling or removing unnecessary services

### 3. Protect Stored Account Data

Organizations must protect stored account data by implementing strong protection methods such as encryption, truncation, masking, and hashing. Data retention and disposal policies should also be in place to minimize storage duration and securely remove data that is no longer needed.

### 4. Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks

Misconfigured wireless networks and vulnerabilities in legacy encryption and authentication protocols continue to be targeted by malicious individuals to gain privileged access to cardholder data environments. To protect against compromise, organizations must use strong encryption protocols during transmission of cardholder data over open, public networks.

### 5. Protect All Systems and Networks from Malicious Software

It is critical that organizations use anti-malware solutions to protect systems from all types of malware, such as:

- viruses
- worms
- Trojans
- spyware
- ransomware
- keyloggers
- rootkits
- malicious code, scripts, and links

Regular updates and scans must be conducted to ensure the systems remain protected against current and evolving threats.

### 6. Develop and Maintain Secure Systems and Software

Malicious individuals can also use security vulnerabilities to gain privileged access to systems.

To reduce this risk, organizations must develop and maintain secure systems and software by following secure coding guidelines and conducting regular security reviews. This includes applying vendor provided security patches promptly to address vulnerabilities.

### 7. Restrict Access to System Components and Cardholder Data by Business Need to Know

Hackers may exploit ineffective access control rules and definitions to gain unauthorized access to critical data or systems.

Organizations must put systems and processes in place to limit access to systems, application, and data based on the principles of least privilege and need to know. That means individuals should have the minimum level of privileges and access to the least amount of data needed to perform their job.

### 8. Identify Users and Authenticate Access to System Components

Organizations must implement strong access control measures to ensure that only authorized individuals can access system components. This includes using multi-factor authentication and unique IDs for all users, removing or disabling inactive user accounts, and setting password requirements.

### 9. Restrict Physical Access to Cardholder Data

Physical access to cardholder data or systems that store, process, or transmit cardholder data must be restricted to prevent unauthorized access. This involves securing physical locations where data is stored and ensuring that access is granted only to authorized personnel.

### 10. Log and Monitor All Access to System Components and Cardholder Data

Comprehensive logging and monitoring of all access to system components and cardholder data must be in place to prevent, detect, or minimize the impact of a data compromise. Logs should be reviewed regularly to detect and respond to unauthorized access or anomalies.

### 11. Test Security of Systems and Networks Regularly

Vulnerabilities are continuously being discovered by malicious individuals and introduced by new software. Organizations must regularly test security systems, processes, and software through vulnerability assessments, penetration testing, and other security testing methods to ensure security controls are effective in a changing environment and to identify and address any new vulnerabilities.

### 12. Support Information Security with Organizational Policies and Programs

A strong information security program supported by organizational policies is crucial for ensuring that all personnel are aware of the sensitivity of cardholder data and their responsibilities for protecting it. This requires organizations to:

- maintain information security and acceptable use policies
- identify, assess, and manage risks to the cardholder data environment
- conduct regular training and awareness programs for employees
- manage third-party risks

### PCI compliance checklist

### PCI DSS compliance checklist

We’ve created an interactive checklist to help you get started on your compliance journey. While our checklist is not exhaustive, it provides a foundational starting point when preparing for PCI DSS compliance.

```
<style>
#pciChecklist {
  padding: 50px;
  background-color: #EBE9E5;
  margin: 40px 0;
}

@media (max-width: 766px) {
  #pciChecklist {
    padding: 40px;
  }
}

#pciChecklist h2 {
  text-align: center;
  margin-bottom: 50px;
  font-weight: 600;
}

#pciChecklist .section-title {
  display: flex;
  justify-content: flex-start;
  align-items: center;
  gap: 20px;
  background-color: #FBFBFB;
  padding: 20px 20px 20px 0;
  margin: 55px 0 30px;
}

#pciChecklist h3 {
  position: relative;
  font-size: 24px;
  font-weight: 500;
  line-height: 1.25;
  color: #091922;
  text-align: left;
}

#pciChecklist h4 {
  margin: 30px 0 15px;
}

#pciChecklist .section-title p {
  position: relative;
  font-size: 18px;
  font-weight: 400;
  line-height: 1.25;
  color: #091922;
  text-align: left;
  width: 100%;
  margin: 10px 0 0 0;
}

#pciChecklist .section-title strong {
  color: #091922;
  font-weight: 500;
}

#pciChecklist .rnd-title {
  font-size: 20px;
  font-weight: 500;
  border-radius: 20px;
  padding: 13px 20px;
  color: #091922;
  margin-left: -28px;
  min-width: 186px;
  line-height: 1;
}

#pciChecklist .bg-purple {
  background-color: #E3DEFF;
}

#pciChecklist .bg-green {
  background-color: #C6FBE5;
}

#pciChecklist .bg-blue {
  background-color: #B1E3FF;
}

#pciChecklist .bg-orange {
  background-color: #FFD3B8;
}

#pciChecklist label {
  color: #091922;
  font-size: 18px;
  line-height: 1.3333;
  display: grid;
  grid-template-columns: 1em auto;
  gap: 0.75em;
}

#pciChecklist input[type="checkbox"] {
  /* Add if not using autoprefixer */
  -webkit-appearance: none;
  /* Remove most all native input styles */
  appearance: none;
  /* For iOS < 15 */
  background-color: transparent;
  /* Not removed via appearance */
  margin: 0;

  font: inherit;
  color: #0e1952;
  width: 1em;
  height: 1em;
  border: 0.15em solid #0e1952;
  border-radius: 0;
  transform: translateY(-0.075em);

  display: grid;
  place-content: center;
  margin-top: 3.5px;
}

#pciChecklist input[type="checkbox"]::before {
  content: "";
  width: 0.58em;
  height: 0.58em;
  clip-path: polygon(14% 44%, 0 65%, 50% 100%, 100% 16%, 80% 0%, 43% 62%);
  transform: scale(0);
  transform-origin: bottom left;
  transition: 120ms transform ease-in-out;
  box-shadow: inset 1em 1em #0e1952;
}

#pciChecklist input[type="checkbox"]:checked::before {
  transform: scale(1);
}

@media (max-width: 766px) {
}

#pciChecklist .rnd-title + .input-group {
  padding-top: 20px;
}

#pciChecklist .input-group + .rnd-title {
  margin-top: 30px;
}

#pciChecklist .input-group {
  padding-left: 10px;
  margin-bottom: 20px;
}

#pciChecklist .input-group.indented {
  margin-left: 50px;
}

@media (max-width: 767px) {
  #pciChecklist h3 {
    font-size: 20px;
    min-height: 40px;
    padding: 12px;
  }
  #pciChecklist .input-group {
    padding-left: 30px;
  }
  #pciChecklist .section-title {
    display: block;
    padding: 20px;
  }
  #pciChecklist .rnd-title {
    width: 100%;
    margin: 0 auto;
  }

  #pciChecklist .section-title p {
    margin: 10px 12px 0;
  }

  #pciChecklist .input-group.indented {
    margin-left: 33px;
  }
}
</style>

<div class="blog-details-content" id="pciChecklist">
      <h2>PCI DSS compliance checklist</h2>

      <div id="sect_1" class="section-title">
        <div class="rnd-title bg-purple">Requirement 1</div>
        <div>
          <h3>
            Install and maintain network security controls
          </h3>
          <p>
            <strong>Goal:</strong> Build and maintain a secure network and
            systems
          </p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem1A-1"
          ><input type="checkbox" id="pciCheckItem1A-1" />Document the testing and approval of network changes</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem1A-2"
          ><input type="checkbox" id="pciCheckItem1A-2" />Develop and maintain configuration standards for network security controls (NSCs)</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem1A-3"
          ><input type="checkbox" id="pciCheckItem1A-3" />Document the review of configurations of NSCs every six months</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem1A-4"
          ><input type="checkbox" id="pciCheckItem1A-4" />Document ports, portals, and services justification for every inbound and outbound rule</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem1B-1"
          ><input type="checkbox" id="pciCheckItem1B-1" />Configure and implement secure NSC settings and rules</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem1B-2"
          ><input type="checkbox" id="pciCheckItem1B-2" />Configure network
          segmentation and network subnets to restrict connections between
          trusted networks and any external untrusted network</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem1B-3"
          ><input type="checkbox" id="pciCheckItem1B-3" />Prevent public direct
          access between the internet and any system component in the internal
          cardholder data environment (CDE)</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem1B-4"
          ><input type="checkbox" id="pciCheckItem1B-4" />Install NSCs on all internet-connected portable devices that are also used to access the cardholder data environment</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem1B-5"
          ><input type="checkbox" id="pciCheckItem1B-5" />Implement security
          features for any insecure services utilized within the cardholder data
          environment</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem1B-6"
          ><input type="checkbox" id="pciCheckItem1B-6" />Install NSCs, such as perimeter firewalls, between all wireless networks and the cardholder data environment</label
        >
      </div>

      <div id="sect_2" class="section-title">
        <div class="rnd-title bg-green">Requirement 2</div>
        <div>
          <h3>
            Apply secure configurations to all system components
          </h3>
          <p>
            <strong>Goal:</strong> Build and maintain a secure network and
            systems
          </p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem2A-1"
          ><input type="checkbox" id="pciCheckItem2A-1" />Document security
          policies and processes to manage vendor default settings and vendor
          security best practice documentation</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem2A-2"
          ><input type="checkbox" id="pciCheckItem2A-2" />Develop and maintain configuration
          standards for all system components</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem2A-3"
          ><input type="checkbox" id="pciCheckItem2A-3" />Create and maintain a
          wireless network security policy</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem2B-1"
          ><input type="checkbox" id="pciCheckItem2B-1" />Change all
          vendor-supplied defaults and remove or disable unnecessary default
          accounts before installing a system on your network</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem2B-1"
          ><input type="checkbox" id="pciCheckItem2B-1" />Remove or disable any unnecessary functionality that is enabled by default, such as scripts, drivers, features, subsystems, file systems, interfaces, and unnecessary web servers</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem2B-2"
          ><input type="checkbox" id="pciCheckItem2B-2" />Change all wireless
          vendor defaults at installation for wireless environments that connect
          to the cardholder data environment or that transmit cardholder
          data</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem2B-3"
          ><input type="checkbox" id="pciCheckItem2B-3" />Implement all systems
          utilizing documented configuration standards and vendor best
          practice</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem2B-4"
          ><input type="checkbox" id="pciCheckItem2B-4" />Encrypt all
          non-console administrative access utilizing strong cryptography</label
        >
      </div>

      <div id="sect_3" class="section-title">
        <div class="rnd-title bg-blue">Requirement 3</div>
        <div>
          <h3>Protect stored account data</h3>
          <p><strong>Goal:</strong> Protect account data</p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem3A-1"
          ><input type="checkbox" id="pciCheckItem3A-1" />Document a data
          retention and disposal policy detailing retention time requirements
          and a secure process for deletion of data</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem3A-2"
          ><input type="checkbox" id="pciCheckItem3A-2" />Define a quarterly
          process for regularly identifying and deleting stored account data
          that exceeds the retention period
        </label>
      </div>
      <div class="input-group">
        <label for="pciCheckItem3A-3"
          ><input type="checkbox" id="pciCheckItem3A-3" />Document a key
          management policy and process defining the secure generation, storage,
          and distribution of encryption keys</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem3B-1"
          ><input type="checkbox" id="pciCheckItem3B-1" />Verify sensitive
          authentication data is not being stored (such as the card verification
          code or PIN) after authorization, even if it is encrypted</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem3B-2"
          ><input type="checkbox" id="pciCheckItem3B-2" />Implement a strong key
          management process including secure storage configurations and
          restricting access to only required key custodians</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem3B-3"
          ><input type="checkbox" id="pciCheckItem3B-3" />Verify PAN is
          unreadable whenever stored and masked when displayed. Only explicitly
          authorized personnel should be able to view unmasked PAN</label
        >
      </div>

      <div id="sect_4" class="section-title">
        <div class="rnd-title bg-orange">Requirement 4</div>
        <div>
          <h3>Protect cardholder data with strong cryptography during transmission over open, public networks</h3>
          <p><strong>Goal:</strong> Protect account data</p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem4A-1"
          ><input type="checkbox" id="pciCheckItem4A-1" />Document the cryptography and security protocols
          in place for encrypting cardholder data when transmitted over open
          public networks with strong cryptography</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem4A-2"
          ><input type="checkbox" id="pciCheckItem4A-2" />Document the
          configuration standards for implementing strong authentication and
          transmission encryption for wireless networks transmitting PAN or connected to the CDE</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem4A-3"
          ><input type="checkbox" id="pciCheckItem4A-3" />Document the process
          for acceptance of trusted keys and certificates</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem4B-1"
          ><input type="checkbox" id="pciCheckItem4B-1" />Identify all locations
          where cardholder data is being sent over public networks and verify
          strong encryption is being used</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem4B-2"
          ><input type="checkbox" id="pciCheckItem4B-2" />Verify when PAN is
          sent over end-user messaging technologies, the PAN data is unreadable
          or secured utilizing strong cryptography</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem4B-3"
          ><input type="checkbox" id="pciCheckItem4B-3" />Ensure only trusted
          keys and certificates are accepted</label
        >
      </div>

      <div id="sect_5" class="section-title">
        <div class="rnd-title bg-purple">Requirement 5</div>
        <div>
          <h3>
            Protect all systems and networks from malicious software
          </h3>
          <p>
            <strong>Goal:</strong> Maintain a vulnerability management program
          </p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem5A-1"
          ><input type="checkbox" id="pciCheckItem5A-1" />Maintain policies for anti-malware including how the software detects, removes, and protects against all known types and forms of malicious software</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem5A-2"
          ><input type="checkbox" id="pciCheckItem5A-2" />Put processes and automated mechanisms in place to detect and protect personnel against phishing attacks</label
        >
      </div>
      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem5B-1"
          ><input type="checkbox" id="pciCheckItem5B-1" />Verify anti-malware
          software is kept current, performs periodic scans, and generates audit
          logs</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem5B-2"
          ><input type="checkbox" id="pciCheckItem5B-2" />Ensure anti-malware
          software is actively running and cannot be disabled by users on all
          systems commonly affected by malware</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem5B-2"
          ><input type="checkbox" id="pciCheckItem5B-2" />Implement and maintain anti-phishing controls </label
        >
      </div>
      <div id="sect_6" class="section-title">
        <div class="rnd-title bg-green">Requirement 6</div>
        <div>
          <h3>Develop and maintain secure systems and software</h3>
          <p>
            <strong>Goal:</strong> Maintain a vulnerability management program
          </p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem6A-1"
          ><input type="checkbox" id="pciCheckItem6A-1" />Document a process to
          identify new security vulnerabilities and assign vulnerability
          risk ratings</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem6A-2"
          ><input type="checkbox" id="pciCheckItem6A-2" />Document change
          control policies and procedures</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem6A-3"
          ><input type="checkbox" id="pciCheckItem6A-3" />Document a software
          development policy including secure coding techniques and processes
          for addressing common coding vulnerabilities</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem6B-1"
          ><input type="checkbox" id="pciCheckItem6B-1" />Perform vulnerability
          assessments against web applications or use an automated technical
          solution such as a web application firewall</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem6B-2"
          ><input type="checkbox" id="pciCheckItem6B-2" />Protect systems from
          known vulnerabilities by installing applicable vendor security
          patches</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem6B-3"
          ><input type="checkbox" id="pciCheckItem6B-3" />Verify software is
          developed based on industry standards or best practice and developed
          in accordance with PCI DSS standards including security throughout the
          development lifecycle</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem6B-4"
          ><input type="checkbox" id="pciCheckItem6B-4" />Ensure code reviews
          are being performed for all production code changes by an individual
          other than the author</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem6B-5"
          ><input type="checkbox" id="pciCheckItem6B-5" />Providing training to software developers at least once every 12 months</label
        >
      </div>

      <div id="sect_7" class="section-title">
        <div class="rnd-title bg-blue">Requirement 7</div>
        <div>
          <h3>Restrict access to system components and cardholder data by business need to know</h3>
          <p><strong>Goal:</strong> Implement strong access control measures</p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem7A-1"
          ><input type="checkbox" id="pciCheckItem7A-1" />Document a policy for
          access control that addresses access need and privilege assignment,
          least privilege, and job classifications</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem7B-1"
          ><input type="checkbox" id="pciCheckItem7B-1" />Inspect system access
          regularly to determine that privileges assigned are necessary for the
          job function and are restricted to least privilege</label
        >
      </div>

      <div id="sect_8" class="section-title">
        <div class="rnd-title bg-orange">Requirement 8</div>
        <div>
          <h3>Identify users and authenticate access to system components</h3>
          <p><strong>Goal:</strong> Implement strong access control measures</p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem8A-1"
          ><input type="checkbox" id="pciCheckItem8A-1" />Document a policy and
          process for the creating, revoking, and modification of access</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem8A-2"
          ><input type="checkbox" id="pciCheckItem8A-2" />Document a policy for
          the management of user IDs including password policy, lockout
          duration, authentication methods, and user guidance on credential
          usage</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem8B-1"
          ><input type="checkbox" id="pciCheckItem8B-1" />Remove or disable any
          accounts within 90 days of inactivity</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem8B-2"
          ><input type="checkbox" id="pciCheckItem8B-2" />Ensure passwords have
          a minimum length of 12 characters and contain both
          alphabetic and numeric characters</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem8B-3"
          ><input type="checkbox" id="pciCheckItem8B-3" />Change user passwords
          at least every 90 days if used as the only authentication factor</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem8B-4"
          ><input type="checkbox" id="pciCheckItem8B-4" />Ensure all non-console
          administrative access and remote access into the cardholder data
          environment requires multi-factor authentication</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem8B-5"
          ><input type="checkbox" id="pciCheckItem8B-5" />Do not use generic
          accounts and do not utilize shared accounts for administrative or
          critical functions</label
        >
      </div>

      <div id="sect_9" class="section-title">
        <div class="rnd-title bg-purple">Requirement 9</div>
        <div>
          <h3>Restrict physical access to cardholder data</h3>
          <p><strong>Goal:</strong> Implement strong access control measures</p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem9A-1"
          ><input type="checkbox" id="pciCheckItem9A-1" />Develop a policy for
          managing, securing, and destroying physical media</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem9A-2"
          ><input type="checkbox" id="pciCheckItem9A-2" />Document a procedure
          for identifying new onsite personnel and visitors, changing access
          requirements, and revoking terminated onsite personnel and expired
          visitor identification</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem9B-1"
          ><input type="checkbox" id="pciCheckItem9B-1" />Implement facility
          entry controls and security controls to limit and monitor physical
          access to areas containing cardholder data</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem9B-2"
          ><input type="checkbox" id="pciCheckItem9B-2" />Implement a visitor
          security program including the use of visitor authorization, visitor
          badges, and visitor logs</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem9B-3"
          ><input type="checkbox" id="pciCheckItem9B-3" />Verify physical media
          management includes securely storing, distributing, and classifying
          media</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem9B-4"
          ><input type="checkbox" id="pciCheckItem9B-4" />Maintain a list of point of interaction (POI) 
          devices and periodically inspect devices for tampering or
          substitution</label
        >
      </div>

      <div id="sect_10" class="section-title">
        <div class="rnd-title bg-green">Requirement 10</div>
        <div>
          <h3>Log and monitor all access to system components and cardholder data</h3>
          <p><strong>Goal:</strong> Regularly monitor and test networks</p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem10A-1"
          ><input type="checkbox" id="pciCheckItem10A-1" />Document policies and
          procedures for monitoring and reviewing log files daily</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem10A-2"
          ><input type="checkbox" id="pciCheckItem10A-2" />Review and document
          logs and security events for all system components to identify
          abnormalities or suspicious activity</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem10B-1"
          ><input type="checkbox" id="pciCheckItem10B-1" />Implement automated
          audit trails for all system components for the following events:
        </label>
      </div>
      <div class="input-group indented">
        <label for="pciCheckItem10B-2"
          ><input type="checkbox" id="pciCheckItem10B-2" />All individual access
          to cardholder data</label
        >
      </div>
      <div class="input-group indented">
        <label for="pciCheckItem10B-3"
          ><input type="checkbox" id="pciCheckItem10B-3" />All actions taken by
          any individual with root or administrative privileges</label
        >
      </div>
      <div class="input-group indented">
        <label for="pciCheckItem10B-4"
          ><input type="checkbox" id="pciCheckItem10B-4" />Access to all audit
          trails</label
        >
      </div>
      <div class="input-group indented">
        <label for="pciCheckItem10B-5"
          ><input type="checkbox" id="pciCheckItem10B-5" />Invalid logical
          access attempts</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem10B-6"
          ><input type="checkbox" id="pciCheckItem10B-6" />Use of and changes to
          identification and authentication mechanisms, including:
        </label>
      </div>
      <div class="input-group indented">
        <label for="pciCheckItem10B-7"
          ><input type="checkbox" id="pciCheckItem10B-7" />All elevation of
          privileges</label
        >
      </div>
      <div class="input-group indented">
        <label for="pciCheckItem10B-8"
          ><input type="checkbox" id="pciCheckItem10B-8" />All changes,
          additions, or deletions to any account with root or administrative
          privileges</label
        >
      </div>
      <div class="input-group indented">
        <label for="pciCheckItem10B-9"
          ><input type="checkbox" id="pciCheckItem10B-9" />Initialization of
          audit logs</label
        >
      </div>
      <div class="input-group indented">
        <label for="pciCheckItem10B-10"
          ><input type="checkbox" id="pciCheckItem10B-10" />Stopping or pausing
          of audit logs</label
        >
      </div>
      <div class="input-group indented">
        <label for="pciCheckItem10B-11"
          ><input type="checkbox" id="pciCheckItem10B-11" />Creation and
          deletion of system level objects</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem10B-12"
          ><input type="checkbox" id="pciCheckItem10B-12" />Verify audit logs
          are retained for three months which are immediately available and one
          year archived</label
        >
      </div>

      <div id="sect_11" class="section-title">
        <div class="rnd-title bg-blue">Requirement 11</div>
        <div>
          <h3>Test security systems and networks regularly</h3>
          <p><strong>Goal:</strong> Regularly monitor and test networks</p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem11A-1"
          ><input type="checkbox" id="pciCheckItem11A-1" />Document a process
          for identifying and removing unauthorized wireless access points and
          inventory all authorized wireless access points in use</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem11A-2"
          ><input type="checkbox" id="pciCheckItem11A-2" />Document a
          methodology used for penetration testing based on industry-accepted
          penetration testing approaches</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem11B-1"
          ><input type="checkbox" id="pciCheckItem11B-1" />Perform quarterly
          internal vulnerability scans and complete quarterly external scans
          utilizing an approved scanning vendor</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem11B-2"
          ><input type="checkbox" id="pciCheckItem11B-2" />Perform internal and
          external penetration testing annually and after any significant
          infrastructure or application upgrade or modification. Segmentation
          testing must be performed bi-annually for service providers</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem11B-3"
          ><input type="checkbox" id="pciCheckItem11B-3" />Implement intrusion
          detection or preventions systems to monitor all traffic at the
          perimeter of the cardholder data environment</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem11B-4"
          ><input type="checkbox" id="pciCheckItem11B-4" />Implement a change
          detection mechanism such as file integrity monitoring to generate
          alerts for unauthorized modification of system and configuration
          files</label
        >
      </div>

      <div id="sect_12" class="section-title">
        <div class="rnd-title bg-orange">Requirement 12</div>
        <div>
          <h3>Support information security with organizational policies and programs</h3>
          <p><strong>Goal:</strong> Maintain an information security policy</p>
        </div>
      </div>
      <h4>Policy and process requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem12A-1"
          ><input type="checkbox" id="pciCheckItem12A-1" />Document an
          information security policy which is reviewed annually and changed in
          relation to the risk environment or business objectives</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem12A-2"
          ><input type="checkbox" id="pciCheckItem12A-2" />Document a risk
          assessment process which includes how to identify assets, threats, and
          vulnerabilities</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem12A-3"
          ><input type="checkbox" id="pciCheckItem12A-3" />Document acceptable
          use policies for all technologies and products in use</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem12A-4"
          ><input type="checkbox" id="pciCheckItem12A-4" />Document an incident
          response plan and procedures to ensure your organization is prepared
          to respond immediately to a system breach</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem12A-5"
          ><input type="checkbox" id="pciCheckItem12A-5" />Document the responsibility of third-party service providers and perform due diligence against their compliance efforts</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem12A-6"
          ><input type="checkbox" id="pciCheckItem12A-6" />Document PCI DSS scope at least once every 12 months and after significant changes</label
        >
      </div>

      <h4>Implementation requirements:</h4>
      <div class="input-group">
        <label for="pciCheckItem12B-1"
          ><input type="checkbox" id="pciCheckItem12B-1" />Formally assign
          information security responsibilities to the appropriate
          personnel</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem12B-2"
          ><input type="checkbox" id="pciCheckItem12B-2" />Train all personnel
          on cardholder data security awareness and require personnel to
          acknowledge they understand all applicable policies and
          procedures at least annually</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem12B-3"
          ><input type="checkbox" id="pciCheckItem12B-3" />Perform background
          screening of prospective employees within constraints of the local
          law</label
        >
      </div>
      <div class="input-group">
        <label for="pciCheckItem12B-4"
          ><input type="checkbox" id="pciCheckItem12B-4" />Review and test the
          incident response plan at least annually</label
        >
      </div>
    </div>
```

# PCI compliance checklist PDF

For a tangible copy of the above checklist, you can download our PCI compliance checklist PDF below.

## PCI compliance checklist

This step-by-step checklist will walk you through the process of preparing for PCI DSS compliance.

###

### Additional requirements for service providers and issuers

There are additional requirements specifically for service providers and issuers that we may not have covered in our checklist above. To see a full list of everything required of you, visit the [official PCI Security Standards website](https://www.pcisecuritystandards.org/).

## How Secureframe can help simplify the PCI DSS compliance process

If the checklist above looks daunting, know that you don’t have to go through the PCI compliance process alone. 

Secureframe has PCI experts who can help you at every step. 

As a Secureframe customer, you can reach out to your compliance manager to have an in-depth discussion about your current environment and scope to help determine exactly which controls are applicable to you and how you can implement them within your environment in order to meet the latest version of PCI DSS.

You can then use the Secureframe platform to assign owners to tasks, controls, and reviews, manage the completion of security awareness training and policy acceptance, complete your risk assessment, and remediate automated tests with the support of our compliance managers. Secureframe compliance managers can also help perform a readiness assessment with you prior to your audit so you can be confident in your PCI DSS v 4.0.1 compliance before your auditor performs the actual assessment.

Finally, you can select one of our [partner QSAs](https://secureframe.com/hub/pci-dss/qsa) to perform fieldwork directly within the platform.

[Request a demo](https://secureframe.com/request-demo) to learn more about how our compliance automation platform can streamline the PCI compliance process.

### What is PCI DSS compliance checklist?

A PCI DSS compliance checklist is a tool designed to help an organization evaluate its compliance with the PCI DSS framework and ensure it has completed the essential steps to prepare for a successful audit. Using the checklist, organizations can check off the boxes to visualize their level of audit readiness and quickly identify any gaps they need to remediate before undergoing an audit.

### What are the steps for PCI DSS compliance?

The steps for PCI DSS compliance include implementing controls to meet the 12 requirements of PCI DSS, which specify the framework for a secure payments environment, and completing either a full report on compliance or self-assessment questionnaire to assess whether your controls meet the 12 requirements. During a readiness assessment or the assessment itself, a QSA may document any gaps in your controls and provide a list of remediation items. The PCI DSS compliance process can therefore be broken down in three essential steps: Assess, Repair and Report.

### What is the first step of PCI DSS compliance?

The first step of PCI DSS compliance is determining which level of compliance you need. This depends on whether you're a merchant or service provider and a few other factors, including the size of your organization, number of annual credit card transactions, and requirements from your customers or acquiring bank. Once you've determined the PCI DSS level you fall under, you can put policies, procedures, and controls in place in order to meet the 12 requirements.

### Who administers PCI DSS?

PCI DSS and related security standards are administered by the PCI Security Standards Council, which was founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc.