Compliance & Assurance

PCI DSS

PCI DSS 4.0.1 (Payment Card Industry Data Security Standard)

By Clear Infosec · Last reviewed: August 2026

PCI DSS is the security standard for organizations that store, process, or transmit payment card data, maintained by the PCI Security Standards Council.

Request a scoping call Official source: PCI Security Standards Council

What is PCI DSS?

PCI DSS defines 12 principal requirements covering network security, data protection, vulnerability management, access control, monitoring, and security policy.

Version 4.0.1 is the current standard. Validation ranges from a Self-Assessment Questionnaire (SAQ) to a Report on Compliance (RoC) by a Qualified Security Assessor, depending on merchant or service-provider level.

Who does PCI DSS apply to?

Any merchant or service provider that stores, processes, or transmits cardholder data, and entities that can affect the security of that data.

Key security expectations

Protect stored cardholder data and encrypt transmission across open networks.
Maintain secure systems: patching and a vulnerability management program.
Restrict access on a need-to-know basis and use strong authentication.
Log and monitor all access to network resources and cardholder data.
Regularly test security systems and processes, including scanning and penetration testing.

How an assessment works

1
Define and validate the cardholder data environment (CDE) scope.
2
Gap assessment against the 12 requirements.
3
Remediate gaps, including segmentation where used to reduce scope.
4
Quarterly vulnerability scans (ASV for external) and annual penetration testing.
5
Complete the applicable SAQ or a QSA-led Report on Compliance.

Typical evidence

Scope and network/data-flow diagrams for the CDEASV scan reports and internal vulnerability scansPenetration test reports (external and internal) and segmentation test resultsAccess control, logging, and monitoring evidenceCompleted SAQ or Report on Compliance

Testing and PCI DSS: PCI DSS Requirement 11.4 calls for external and internal penetration testing at least annually and after significant changes, plus segmentation testing where segmentation isolates the CDE. Requirement 11.3 covers internal and external vulnerability scans (external scans by an Approved Scanning Vendor).

How Clear Infosec helps with PCI DSS

Related Clear Infosec services that support PCI DSS:

Vulnerability Assessment & Penetration Testing

Find and prove real risk before attackers do.

Attack Surface Assessments

See what an attacker sees.

Risk Assessment & Compliance Readiness

Know your risk. Be audit-ready.

Security Architecture Reviews

Secure by design, across network and application.

Frequently asked questions

What penetration testing does PCI DSS require?

PCI DSS Requirement 11.4 requires external and internal penetration tests at least once a year and after significant changes. Where segmentation is used to reduce scope, segmentation penetration testing is also required.

How often are vulnerability scans required for PCI DSS?

Requirement 11.3 requires internal and external vulnerability scans at least quarterly and after significant changes. External scans must be performed by a PCI Approved Scanning Vendor (ASV).

Who does PCI DSS apply to?

Any organization that stores, processes, or transmits cardholder data, and entities that could affect the security of that data. Validation requirements vary by merchant and service-provider level.

This page is general information, not legal or regulatory advice. Requirements are defined by the authoritative body linked above.

Preparing for PCI DSS?

Talk to Clear Infosec about a readiness assessment, gap analysis, or testing aligned to PCI DSS.