PCI DSS v4.0

Payment card industry software security: component inventory, vulnerability identification, integrity.


Short name	PCI DSS
Region	International
Country or scope	International
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PCI DSS

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 19 controls from Safeguard's control catalog for PCI DSS.
Automated tests: 658 map to its controls, and 343 connectors provide automated evidence for them. See PCI DSS and connectors.
Policy templates: 26: 4 written for PCI DSS and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`PCI-6-3-2` Software Component Inventory	An inventory of bespoke and custom software, including third-party components incorporated into it, must be maintained to support vulnerability and patch management (PCI DSS v4.0 Req. 6.3.2)	Scan
`PCI-6-3-1` Vulnerability Identification	Security vulnerabilities in software must be identified using industry-recognized sources and ranked by risk, which requires components to carry identifiers resolvable against those sources (PCI DSS v4.0 Req. 6.3.1)	Scan
`PCI-6-3-3` Patch Currency	Applicable security patches must be identified and installed within defined timeframes, which requires the exact version of every component to determine patch applicability (PCI DSS v4.0 Req. 6.3.3)	Scan
`PCI-6-2-4` Software Integrity Protections	Software engineering practice must prevent and detect tampering of software, supported by integrity hashes for the components composing payment software (PCI DSS v4.0 Req. 6.2.4 secure software engineering techniques)	Scan
`PCI-12-8-1` Third-Party Provider Accountability	A list of third-party service providers and software suppliers with which account data or its processing environment is shared must be maintained, requiring supplier identity per component (PCI DSS v4.0 Req. 12.8.1, applied to software supply chain)	Scan
`PCI-6-3-2-DOC` Inventory Completeness	The 6.3.2 inventory is only usable for vulnerability management when each listed component records both its name and version (PCI DSS v4.0 Req. 6.3.2 guidance)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`1.1`	Network Security Controls: Processes and Mechanisms
`1.3`	Restrict Inbound and Outbound Traffic to CDE
`2.2`	System Components Configuration Standards
`3.3`	Sensitive Authentication Data Not Retained After Authorisation
`3.5`	Primary Account Number (PAN) Security
`4.2`	PAN Secured During Transmission
`5.2`	Malware Protection Mechanisms
`6.2`	Bespoke and Custom Software Security
`6.3.2`	Software Bill of Materials (SBOM) Maintenance
`6.3.3`	Software Component Vulnerability Tracking
`7.2`	Access Control System Implementation
`8.3`	User Authentication for Strong Authentication
`10.2`	Audit Log Implementation
`10.5`	Audit Log Retention and Protection
`11.3`	External and Internal Vulnerability Scans
`11.4`	External and Internal Penetration Testing
`12.3`	Risk Assessment and Targeted Risk Analysis
`12.10`	Incident Response Plan
`12.6`	Security Awareness Education

Policy templates

Written for PCI DSS:

Cardholder Data Environment (CDE) Scoping Policy
Software Bill of Materials (SBOM) Policy for PCI DSS
Payment Security Incident Response Plan
CDE Access Control and Privileged Access Policy

And 22 from the standard set, adapted to PCI DSS.