PCI DSS v4.0
ActiveCore framework
Best for: Compliance with PCI DSS is required for any organization that stores, processes, or transmits cardholder data, which, at a minimum, consists of the full primary account number (PAN). It applies to any company, no matter the size or number of transactions.
| Mandatory? | Mandatory for any entity processing card data |
|---|---|
| Who validates? | QSA (Level 1 merchants/SPs); SAQ self-assessment (Levels 2–4) |
| Renewal | Annual |
| Scope | Cardholder data environment (CDE) and connected systems |
| Governing body | PCI Security Standards Council (PCI SSC), PCI DSS v4.0. Official source |
Controls by category
54 controls are Mapped to PCI DSS v4.0.
1.2.5: Network security controls (NSCs) are configured and maintained.
1.2.8: Network security controls (NSCs) are configured and maintained.
1.3.1: Network access to and from the cardholder data environment is restricted.
1.3.2: Network access to and from the cardholder data environment is restricted.
1.4.1: Network connections between trusted and untrusted networks are controlled.
1.4.2: Network connections between trusted and untrusted networks are controlled.
1.4.4: Network connections between trusted and untrusted networks are controlled.
1.5.1: Risks to the CDE from computing devices that are able to connect to both untrusted networks and the CDE are mitigated.
10.2.1.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.3: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.4: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.5: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.6: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1.7: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.1: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.2.2: Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events.
10.3.1: Audit logs are protected from destruction and unauthorized modifications.
10.3.2: Audit logs are protected from destruction and unauthorized modifications.
10.3.3: Audit logs are protected from destruction and unauthorized modifications.
10.3.4: Audit logs are protected from destruction and unauthorized modifications.
10.4.1.1: Audit logs are reviewed to identify anomalies or suspicious activity.
10.4.1: Audit logs are reviewed to identify anomalies or suspicious activity.
10.4.2: Audit logs are reviewed to identify anomalies or suspicious activity.
10.4.3: Audit logs are reviewed to identify anomalies or suspicious activity.
10.5.1: Audit log history is retained and available for analysis.
10.6.3: Time-synchronization mechanisms support consistent time settings across all systems.
10.7.1: Failures of critical security control systems are detected, reported, and responded to promptly.
10.7.2: Failures of critical security control systems are detected, reported, and responded to promptly.
11.3.1.2: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
11.3.1.3: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
11.3.1: External and internal vulnerabilities are regularly identified, prioritized, and addressed.
11.5.1.1: Network intrusions and unexpected file changes are detected and responded to.
11.5.1: Network intrusions and unexpected file changes are detected and responded to.
11.5.2: Network intrusions and unexpected file changes are detected and responded to.
11.6.1: Unauthorized changes on payment pages are detected and responded to.
12.10.5: Suspected and confirmed security incidents that could impact the CDE are responded to immediately.
2.2.5: System components are configured and managed securely.
2.2.7: System components are configured and managed securely.
3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
3.5.1: Primary account number (PAN) is secured wherever it is stored.
3.6.1.2: Cryptographic keys used to protect stored account data are secured.
3.6.1.3: Cryptographic keys used to protect stored account data are secured.
3.6.1.4: Cryptographic keys used to protect stored account data are secured.
3.6.1: Cryptographic keys used to protect stored account data are secured.
3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
4.2.1.1: PAN is protected with strong cryptography during transmission.
4.2.1: PAN is protected with strong cryptography during transmission.
5.3.4: Anti-malware mechanisms and processes are active, maintained, and monitored.
6.3.3: Security vulnerabilities are identified and addressed.
| Control | Status |
|---|---|
| Function apps should use the latest supported runtime version (~4) | Mapped |
7.2.1: Access to system components and data is appropriately defined and assigned.
7.2.2: Access to system components and data is appropriately defined and assigned.
7.2.3: Access to system components and data is appropriately defined and assigned.
7.2.5: Access to system components and data is appropriately defined and assigned.
7.2.6: Access to system components and data is appropriately defined and assigned.
7.3.1: Access to system components and data is managed via an access control system(s).
7.3.2: Access to system components and data is managed via an access control system(s).
7.3.3: Access to system components and data is managed via an access control system(s).
8.2.2: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
| Control | Status |
|---|---|
| Non-RBAC key vaults should have 'Expiration Date' configured for all secrets | Mapped |
8.2.6: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
| Control | Status |
|---|---|
| Non-RBAC key vaults should have 'Expiration Date' configured for all secrets | Mapped |
8.2.7: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
8.2.8: User identification and related accounts for users and administrators are strictly managed throughout an accounts lifecycle.
8.3.10.1: Strong authentication for users and administrators is established and managed.
8.3.2: Strong authentication for users and administrators is established and managed.
8.3.4: Strong authentication for users and administrators is established and managed.
8.3.5: Strong authentication for users and administrators is established and managed.
8.3.7: Strong authentication for users and administrators is established and managed.
8.3.9: Strong authentication for users and administrators is established and managed.
8.4.1: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
8.4.2: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
8.4.3: Multi-factor authentication (MFA) is implemented to secure access into the CDE.
8.6.3: Use of application and system accounts and associated authentication factors is strictly managed.
A1.1.2: Multi-tenant service providers protect and separate all customer environments and data.
A1.1.3: Multi-tenant service providers protect and separate all customer environments and data.
A1.2.1: Multi-tenant service providers facilitate logging and incident response for all customers.
A1.2.3: Multi-tenant service providers facilitate logging and incident response for all customers.
A3.3.1: PCI DSS is incorporated into business-as-usual (BAU) activities.
A3.4.1: Logical access to the cardholder data environment is controlled and managed.
A3.5.1: Suspicious events are identified and responded to.
Related frameworks
| Framework | Control overlap | Note |
|---|---|---|
| NIS2 Directive (EU 2022/2555) | High 93% | |
| CIS Azure Benchmark v2.0.0 | High 85% | |
| CIS Azure Benchmark v2.1.0 | High 80% |
Frequently asked questions
Who must comply with PCI DSS?
PCI DSS applies to any company, no matter the size or number of transactions, that accepts, transmits, or stores cardholder data.
What are the PCI DSS merchant validation levels?
Companies are validated at one of four levels based on total transaction volume over a 12-month period. Level 1 is over 6 million transactions a year, Level 2 is 1 million to 6 million, Level 3 is 20,000 to 1 million, and Level 4 is fewer than 20,000.
How long is a PCI DSS Attestation of Compliance valid?
The effective period for compliance begins upon passing the audit and receiving the AoC from the Qualified Security Assessor (QSA). It ends one year from the date the AoC is signed.
Does Azure's PCI DSS status make my own workload compliant?
Azure's PCI DSS compliance status doesn't automatically translate to PCI DSS validation for services you build or host on Azure. You are responsible for achieving compliance with PCI DSS requirements for your own solution.