What is PCI DSS v4.0?

PCI DSS (Payment Card Industry Data Security Standard) v4.0 is the security standard maintained by the PCI Security Standards Council for any organization that stores, processes or transmits cardholder data. It is built around 12 core requirements.

How many requirements does PCI DSS have?

PCI DSS is organized into 12 principal requirements grouped under six control objectives, expanding into hundreds of individual sub-requirements that apply to the cardholder-data environment.

Who needs to comply with PCI DSS?

Any merchant or service provider that stores, processes or transmits payment card data must comply with PCI DSS, and the MSPs supporting those cardholder-data environments are in scope for the controls they manage.

How does SBCMSP help with PCI DSS v4.0?

SBCMSP continuously maps its coverage to the PCI DSS v4.0 requirements, including the new v4 future-dated items, scores each control as pass, partial or fail, and produces a white-label, audit-ready report for the client and assessor.

All frameworks

PCI Security Standards Council

PCI DSS v4.0 compliance for clients that take card payments

Official source: PCI Security Standards Council

Track all 12 PCI DSS v4.0 requirements across your clients’ cardholder-data environment — network security, access control, monitoring and the new v4 future-dated items.

Get started Read the checklist

PCI DSS v4 · requirements 51 / 64

Req 1Network security controlsPASS

Req 3Protect stored account dataPASS

Req 4Strong cryptography in transitPASS

Req 8Identify & authenticate (MFA)PARTIAL

Req 6Secure systems & softwarePARTIAL

Req 11Test security regularlyFAIL

PCI DSS is one of ten frameworks mapped from a single scan

SOC 2

HIPAA

PCI DSS v4

NIST CSF 2.0

CMMC

ISO 27001

CIS v8

FTC Safeguards

Cyber Essentials

NIST 800-171

Coverage

How SBCMSP maps PCI DSS

Continuous monitoring across every control family — 64 controls, scored on each scan.

Build & maintain security

Firewalls, secure config and segmentation.

Protect account data

Encryption at rest and in transit.

Access control

Least privilege, MFA and unique IDs.

Monitor & test

Logging, vulnerability scans and pen tests.

Policy

An information-security policy program.

Evidence & reporting

Auto-collected evidence and a white-label, audit-ready PDF for every control.

Who it’s for Merchants, service providers and MSPs supporting any cardholder-data environment.

Resources Start with the PCI DSS v4 checklist, then read our guide to external attack surface management.

Continuous, not point-in-time

Audit-ready all year — not just at renewal

Instead of a frantic evidence scramble before the audit, SBCMSP monitors each PCI DSS control continuously and flags drift the moment it happens.

Control-level pass / partial / fail status
Auto-collected, timestamped evidence
Gap remediation guidance per control
White-label report for the client & auditor

readiness · acme-corp80%

Controls passing51 / 64

Evidence collected94%

Open gaps3

Keep exploring

Other frameworks we map

SOC 2 HIPAA NIST CSF CMMC ISO 27001 CIS v8 FTC Safeguards Cyber Essentials CIS Controls

Get your clients PCI DSS-ready faster

Run a readiness assessment in minutes and see exactly which controls need work.

Get started Read the checklist