PCI DSS 4.0 (Full)

SBOM maintenance (6.3.2), third-party component tracking (6.3.3), vulnerability management.


Short name	PCI 4.0
Region	International
Country or scope	International
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PCI 4.0

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for PCI 4.0.
Automated tests: none map to it directly. Evidence from the frameworks the crosswalk relates it to counts toward its controls where a reviewed or approved equivalent row links them (the crosswalk).
Policy templates: 25: 3 written for PCI 4.0 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`PCI4-6-3-2` Maintained Component Inventory (SBOM)	Bespoke and custom software must have a maintained inventory of incorporated third-party components: effectively an SBOM, kept current across releases (PCI DSS v4.0 Req. 6.3.2)	Scan
`PCI4-6-3-2-FMT` Automatable Inventory Format	To support continuous vulnerability management at scale, the component inventory should be produced in a standardized machine-readable SBOM format (PCI DSS v4.0 Req. 6.3.2 good-practice guidance)	Scan
`PCI4-6-4-3` Payment Script Integrity	Scripts loaded and executed on payment pages must be managed with integrity assurance and an inventory with written justification; at SBOM level this maps to integrity hashes on components (PCI DSS v4.0 Req. 6.4.3)	Scan
`PCI4-6-3-1` Continuous Vulnerability Identification	New vulnerabilities affecting the software and its third-party components must be identified from industry sources, requiring resolvable identifiers per component (PCI DSS v4.0 Req. 6.3.1)	Scan
`PCI4-6-5-1` Change-Controlled Versions	Changes to system components must follow documented change control, requiring precise, unambiguous version identification of components rather than floating references (PCI DSS v4.0 Req. 6.5.1)	Scan
`PCI4-12-8-1` Third-Party Component Tracking	Relationships with third-party providers of software incorporated into the cardholder data environment must be tracked, requiring the supplier of each component to be recorded (PCI DSS v4.0 Req. 12.8.1)	Scan
`PCI4-6-3-3` Patch Applicability Data	Critical patches must be installed within one month of release, which requires current version data on all components to establish applicability (PCI DSS v4.0 Req. 6.3.3)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`6.3.2`	SBOM for All Software in CDE
`6.3.3`	Third-Party Software Component Patch Management
`12.3.4`	Hardware and Software Technologies Review
`8.6`	System and Application Accounts Management
`4.2.1`	Strong Cryptography for PAN in Transit
`10.7`	Failures of Critical Security Controls Detected and Reported
`11.6.1`	Change and Tamper Detection for Payment Pages
`3.7.1`	Cryptographic Key Management Policy
`5.4`	Phishing-Resistant Authentication
`2.3.2`	Wireless Environment Security
`1.5.1`	Security Controls on Any Devices Connecting to Internet and CDE
`12.9`	Third-Party Service Provider (TPSP) Security Obligations
`7.3.2`	All User Access Controlled by Access Control System
`12.6`	Security Awareness Education

Policy templates

Written for PCI 4.0:

PCI DSS 4.0 Customised Approach Implementation Policy
E-Commerce Payment Page Security Policy
Targeted Risk Analysis Policy

And 22 from the standard set, adapted to PCI 4.0.