implementing-pci-dss-compliance-controls

Follow a six-phase workflow: scope the cardholder data environment, deploy network security controls and segmentation, encrypt stored and transmitted data, enforce RBAC and MFA, implement logging and vulnerability testing, and establish security policies. The process typically spans about 42 weeks.

The 12 requirements cover network security controls, secure configurations, stored account data protection, transmission encryption, anti-malware, secure development, need-to-know access, authentication, physical access, logging and monitoring, security testing, and information security policies.

PCI DSS 4.0 adds a customized approach for objective-based validation, MFA for all CDE access under requirement 8.4.2, targeted risk analysis for flexible requirements, authenticated internal vulnerability scanning, anti-phishing controls, and automated log review. New requirements became mandatory March 31, 2025.

Segmentation is often documented on diagrams but not technically enforced, leaving flat VLANs or permissive firewall rules that let out-of-scope hosts reach the CDE. Verify with an actual segmentation penetration test under requirement 11.4.5 rather than reviewing diagrams.

Yes, requirement 8.4.2 extends MFA beyond administrators to all access into the cardholder data environment. Test a non-admin account logging into a CDE system to confirm enforcement, since admin-only MFA is a common assessment failure.