Payment security standardInternational

PCI DSS v4.0.1 Compliance and Payment-Security Readiness

Bring current PCI DSS requirements into continuous managed operation across a correctly scoped cardholder data environment.

View the control mapping

Where we contribute

A managed security layer within a broader compliance program.

PCI DSS applies to the people, processes, technologies, facilities, payment channels, providers, and evidence involved in storing, processing, or transmitting account data, as well as those affecting the security of the cardholder data environment. Network Box can operate substantial technical controls, but it does not certify compliance or replace a QSA, ISA, ASV, or the entity that accepts the client's validation.

Current standard status

Reviewed September 2, 2026

PCI DSS v4.0.1 is the currently published standard.

PCI SSC published v4.0.1 as a limited revision in June 2024. PCI DSS v4.0 retired on December 31, 2024, and the future-dated v4.x requirements became effective on March 31, 2025.

Read PCI SSC's v4.0.1 announcement ↗

PCI DSS v4.0.1 did not add or remove requirements; it clarified wording, applicability, and guidance.
Requirements formerly described as future-dated are now effective requirements, not optional preparation items.
Active examples include expanded MFA, authenticated internal scanning, automated public-facing application protection, payment-page script controls, browser-facing tamper detection, and targeted risk analyses.
PCI SSC maintains the standard, while payment brands, acquirers, and other compliance programs determine validation and submission obligations.
Each entity should confirm its merchant or service-provider level, reporting route, validation documents, and deadlines with the receiving organization.

Scope and applicability

Start with the payment environment, not the questionnaire.

A defensible PCI program begins by locating account data and identifying every person, process, technology, facility, service, and connection that can store, process, transmit, or affect it.

Cardholder data

Know where PAN exists

PAN and any associated cardholder name, expiration date, or service code must be mapped, minimized, protected, retained only as needed, and securely deleted.

Sensitive authentication data

Do not retain it after authorization

Full track data, card verification codes or values, and PIN/PIN-block data generally may not be stored after authorization, even when encrypted.

CDE scope

Include security-impacting systems

Identity, security, administration, logging, virtualization, cloud control planes, software delivery, and connected systems may be in scope even without directly storing card data.

Validation

Confirm the required reporting route

The applicable payment brand, acquirer, or compliance-accepting entity determines the required SAQ, AOC, ROC, ASV evidence, assessor involvement, and submission schedule.

Control mapping

PCI DSS v4.0.1 requirements and Network Box support.

The twelve requirement families below distinguish continuous managed-security contributions from the merchant or service provider responsibilities that remain necessary for assessment and validation.

Authoritative sourcePCI Security Standards Council document library ↗

Select a framework area to explore its detailed control mapping.
Framework area	Network Box contribution	Relevant services	Coverage
	Managed boundaries, segmentation, secure connectivity, rule changes, inspection, and monitoring restrict traffic within scope.	UTM+FirewallsSecure SD-WANVPNNetwork segmentationIDS/IPS24/7 SOC	Strong
Detailed mapping2 mapping notes Define, configure, maintain, review, and document network security controls that restrict connections and traffic between trusted and untrusted networks and within the CDE. Network Box contribution Strong Network Box manages firewalls, SD-WAN, VPN, segmentation, traffic policy, IDS/IPS, controlled changes, configuration records, and continuous monitoring for subscribed systems. Relevant capabilities UTM+FirewallsSecure SD-WANVPNNetwork segmentationIDS/IPS24/7 SOC Assessed entity responsibility Client responsibility Identify the complete CDE and connected systems, maintain current network and data-flow diagrams, approve business justifications, control all inbound and outbound traffic, review rule sets at least every six months, and validate controls outside scope. Relevant capabilitiesNot a Network Box control
	Secure configurations, restricted administration, updates, change records, and monitoring protect managed services.	Managed platform operationsUTM+Secure SD-WANSecure Web GatewayWAFManaged Cloud Email Security	Partial
Detailed mapping2 mapping notes Develop, apply, and maintain secure configuration standards for all system components and eliminate unnecessary functions, accounts, services, and insecure defaults. Network Box contribution Partial Network Box applies controlled configurations to subscribed services, restricts administration, manages supported updates, disables unnecessary managed functions, records changes, and monitors relevant conditions. Relevant capabilities Managed platform operationsUTM+Secure SD-WANSecure Web GatewayWAFManaged Cloud Email Security Assessed entity responsibility Client responsibility Securely configure and inventory every server, endpoint, payment device, network device, cloud resource, application, database, virtual platform, container, wireless system, and administrative tool outside Network Box management. Relevant capabilitiesNot a Network Box control
	Segmentation, access restrictions, monitoring, and detection reduce exposure but do not replace storage minimization or cryptography.	Network segmentationAccess controlsWAFSIEMNBX: MDR, EDR, XDR	Supporting
Detailed mapping2 mapping notes Minimize account-data storage, prohibit retention of sensitive authentication data after authorization, render stored PAN unreadable, mask displays, and govern retention, deletion, cryptography, and keys. Network Box contribution Supporting Network Box can restrict access paths, segment storage environments, monitor connected systems, protect applications, and detect suspicious activity while reducing PAN exposure in managed telemetry. Relevant capabilities Network segmentationAccess controlsWAFSIEMNBX: MDR, EDR, XDR Assessed entity responsibility Client responsibility Locate every account-data store, eliminate prohibited data, minimize retention, encrypt or otherwise render PAN unreadable, mask displays, protect backups, prevent leakage into logs, securely delete records, and manage cryptographic keys. Relevant capabilitiesNot a Network Box control
	Managed encrypted connectivity and gateway controls protect covered public-network paths and reveal unexpected communications.	VPNSecure SD-WANUTM+Secure remote accessGateway controlsNetwork monitoring	Strong
Detailed mapping2 mapping notes Use strong cryptography and secure protocols to protect cardholder data transmitted across open, public networks and prevent unprotected PAN transmission through end-user messaging technologies. Network Box contribution Strong Network Box provides VPN, encrypted site connectivity, secure remote-access paths, gateway policy, traffic inspection, and monitoring for configured managed paths. Relevant capabilities VPNSecure SD-WANUTM+Secure remote accessGateway controlsNetwork monitoring Assessed entity responsibility Client responsibility Inventory every browser, application, API, wireless, email, messaging, file-transfer, remote-access, and third-party path; manage certificates and keys; prohibit insecure fallback; and validate end-to-end protection beyond managed tunnels. Relevant capabilitiesNot a Network Box control
	Layered network, email, web, endpoint, intelligence, and SOC controls prevent and respond to malware.	Anti-malwareSecure Web GatewayManaged Cloud Email SecurityUTM+NBX: MDR, EDR, XDRThreat intelligence24/7 SOC	Strong
Detailed mapping2 mapping notes Deploy active, current, monitored anti-malware mechanisms on systems at risk and periodically evaluate systems considered not at risk. Network Box contribution Strong Network Box detects and blocks malicious files, content, traffic, and behavior, maintains managed protections, investigates alerts, and supports containment within the subscribed scope. Relevant capabilities Anti-malwareSecure Web GatewayManaged Cloud Email SecurityUTM+NBX: MDR, EDR, XDRThreat intelligence24/7 SOC Assessed entity responsibility Client responsibility Ensure every applicable in-scope system is covered, evaluate exclusions, prevent unauthorized disabling, retain logs, address removable media and unmanaged assets, and remediate affected systems. Relevant capabilitiesNot a Network Box control
	Vulnerability findings, WAF, threat response, advisories, and controlled managed-service changes support secure operation.	Vulnerability ManagementWAFIDS/IPSSIEMNBX: MDR, EDR, XDRThreat intelligence	Partial
Detailed mapping2 mapping notes Identify and remediate vulnerabilities, securely develop and change software, protect public-facing applications, and control browser-executed payment-page scripts. Network Box contribution Partial Network Box identifies weaknesses, helps prioritize remediation, detects or blocks exploitation, can provide automated WAF protection, monitors production activity, and documents changes to its managed services. Relevant capabilities Vulnerability ManagementWAFIDS/IPSSIEMNBX: MDR, EDR, XDRThreat intelligence Assessed entity responsibility Client responsibility Patch critical vulnerabilities within required timelines, own secure development and code review, protect delivery pipelines, manage dependencies, inventory and validate payment-page scripts, cover every applicable application, and confirm the exact 6.4.2 and 6.4.3 implementations. Relevant capabilitiesNot a Network Box control
	Network policy, segmentation, managed roles, secure remote access, and telemetry support least-privilege enforcement.	UTM+Network segmentationVPNSecure SD-WANDirectory integrationSIEM	Partial
Detailed mapping2 mapping notes Limit access to system components and cardholder data according to job function and least privilege, using systems that deny access unless expressly allowed. Network Box contribution Partial Network Box firewalls, segmentation, VPN policy, managed administrative roles, supported identity integration, and logging restrict network and service access within scope. Relevant capabilities UTM+Network segmentationVPNSecure SD-WANDirectory integrationSIEM Assessed entity responsibility Client responsibility Define job roles, approve and periodically review access, manage privileged and service accounts, enforce application, database, operating-system, cloud, and data-layer permissions, and revoke access promptly. Relevant capabilitiesNot a Network Box control
	Unique managed-service accounts, secure administration, supported MFA, directory integration, and logging protect managed access.	VPNMFA/TOTP supportDirectory integrationManaged administrative accessAuthentication loggingSIEM	Partial
Detailed mapping2 mapping notes Uniquely identify users, protect credentials, govern account lifecycle, and use MFA for access into the CDE and other scenarios required by PCI DSS. Network Box contribution Partial Network Box supports unique administrative accounts, secure remote administration, compatible MFA and directory integration, authentication records, monitoring, and alerting. Relevant capabilities VPNMFA/TOTP supportDirectory integrationManaged administrative accessAuthentication loggingSIEM Assessed entity responsibility Client responsibility Implement joiner-mover-leaver controls, strong authentication, complete CDE MFA coverage, credential protection, dormant-account review, permitted shared-account exceptions, and governance of application and service accounts across every in-scope technology. Relevant capabilitiesNot a Network Box control
	Service and assurance information can support review of facilities used for Network Box-managed services.	Service documentationAssurance documentationNetwork monitoringNetwork segmentation	Supporting
Detailed mapping2 mapping notes Restrict physical access to cardholder data, systems, media, devices, sensitive areas, and point-of-interaction equipment and maintain the required records and inspections. Network Box contribution Supporting Network Box can provide available service and assurance information, while monitoring and segmentation may reduce some consequences of unauthorized physical access. Relevant capabilities Service documentationAssurance documentationNetwork monitoringNetwork segmentation Assessed entity responsibility Client responsibility Control facilities, visitors, wiring areas, media, backups, workstations, and payment devices; inspect terminals for tampering or substitution; authorize access; retain records; securely destroy media; and evaluate provider facilities. Relevant capabilitiesNot a Network Box control
	Connected telemetry, correlation, continuous analyst review, alerting, investigations, dashboards, and reports support auditability.	SIEMNBX: MDR, EDR, XDRManaged-device logging24/7 SOCCorrelationDashboardsSecurity reporting	Strong
Detailed mapping2 mapping notes Record and examine activity in systems and account data, protect logs, review security events at required frequencies, investigate anomalies, synchronize time, and retain sufficient audit history. Network Box contribution Strong Network Box collects connected logs, monitors managed services, correlates events, investigates alerts, tracks silent sources, provides time-synchronized security telemetry, and produces dashboards and reports. Relevant capabilities SIEMNBX: MDR, EDR, XDRManaged-device logging24/7 SOCCorrelationDashboardsSecurity reporting Assessed entity responsibility Client responsibility Enable required records on every in-scope system, preserve user and event context, protect logs from alteration, investigate exceptions, continuously verify source coverage, retain at least 12 months with the most recent three months immediately available, and document recurring reviews. Relevant capabilitiesNot a Network Box control
	Vulnerability assessment, monitoring, attack detection, change telemetry, WAF, and SOC investigations support recurring testing.	Vulnerability ManagementAuthenticated scanningIDS/IPSWAFSIEMNBX: MDR, EDR, XDR24/7 SOC	Partial
Detailed mapping2 mapping notes Regularly scan, test, and validate security systems, applications, wireless exposure, intrusion detection, change detection, payment pages, and segmentation using required methods and qualified independence. Network Box contribution Partial Network Box can perform agreed vulnerability assessment, support authenticated scanning where included, monitor attacks and changes, supply boundary evidence, track findings, and assist with remediation and rescans. Relevant capabilities Vulnerability ManagementAuthenticated scanningIDS/IPSWAFSIEMNBX: MDR, EDR, XDR24/7 SOC Assessed entity responsibility Client responsibility Arrange required internal and external ASV scans, scans after significant changes, penetration and segmentation tests, wireless detection, payment-page tamper controls, qualified independence, passing results, remediation, and retesting across the complete PCI scope. Relevant capabilitiesNot a Network Box control
	Responsibilities, reporting, intelligence, response support, awareness training, and operational records support the entity's program.	Service documentationResponsibility assignmentsThreat intelligenceSecurity reportingIncident responseSecurity Awareness TrainingService reviews	Partial
Detailed mapping2 mapping notes Maintain governance, policies, risk analyses, scope confirmation, security awareness, incident response, service-provider oversight, and documented responsibility for protecting account data. Network Box contribution Partial Network Box can document its contracted responsibilities, provide threat and risk information, report security operations, train users when subscribed, support incident exercises, and furnish evidence and provider-status information. Relevant capabilities Service documentationResponsibility assignmentsThreat intelligenceSecurity reportingIncident responseSecurity Awareness TrainingService reviews Assessed entity responsibility Client responsibility Own policy and governance, annual scope confirmation, targeted risk analyses, role assignment, acceptable use, annual response testing, workforce training, TPSP inventory and monitoring, responsibility matrices, compliance submissions, and executive accountability. Relevant capabilitiesNot a Network Box control

These mappings are illustrative and depend on deployment, configuration, service scope, the client environment, and evidence requirements. Strong, Partial, and Supporting describe Network Box's potential contribution, not a compliance conclusion.

Segmentation and scope

Segmentation can reduce scope, but it must be proven.

Network Box firewalls, routing, VLAN controls, SD-WAN policy, access restrictions, and monitoring can establish a strong segmentation foundation. The assessed entity must still map every account-data flow and security-impacting dependency, apply documented least-access paths, test segmentation at required frequencies and after applicable changes, and have the assessor confirm whether isolation is effective for PCI DSS scope reduction.

Architecture-specific validation

Similar security activities are not interchangeable.

Several active v4.0.1 requirements depend on exact technical scope, implementation, cadence, independence, and testing evidence. General product capability is not enough.

6.4.2 · Public-facing applications

An appropriately scoped, current, monitored, and actively blocking WAF can strongly support the required automated protection, but every applicable application and response process must be covered.

6.4.3 · Payment-page scripts

The entity must authorize browser-executed scripts, assure their integrity, and maintain a justified inventory. A traditional WAF alone does not establish these outcomes.

11.6.1 · Browser-facing tamper detection

The mechanism must evaluate payment-page headers and content as received by the consumer's browser. Server-side monitoring alone may not satisfy the requirement.

Internal vulnerability scanning

Confirm complete in-scope coverage, required authenticated scanning, qualified independence, passing criteria, rescans, and scans after applicable significant changes.

External ASV scanning

A standard vulnerability report is not automatically an ASV scan. Required external compliance scans must use a PCI SSC Approved Scanning Vendor and achieve the required passing result.

Penetration and segmentation testing

Vulnerability scanning does not replace penetration testing. Required tests need compliant scope, methodology, independence, cadence, remediation, and retesting evidence.

Assessment evidence

Show that safeguards are operating.

Available evidence depends on deployed services, configured log sources, agreed scope, format, and retention period.

01Service descriptions, scope statements, contracts, and responsibility assignments
02Inventories of managed devices, services, protected endpoints, and connected log sources
03Network and account-data-flow diagrams with managed boundaries, connections, and segments
04Firewall, VPN, SD-WAN, routing, segmentation, web, email, IDS/IPS, and WAF policies
05Business justifications, approvals, changes, and periodic reviews for managed network rules
06Secure configuration information, managed updates, and change records
07Administrative access, authentication, and MFA records for managed services
08Centralized logs, log-source health, audit trails, searches, dashboards, and reports
09Evidence of recurring security-event review, alert handling, escalation, and follow-up
10Time-synchronization information for managed devices and services
11SOC alerts, investigations, incident tickets, timelines, and response actions
12Vulnerability scan results, authenticated-scan details, trends, remediation advice, and rescans
13WAF events, blocked attacks, policy changes, and monitored-coverage information
14Malware, email, web, endpoint, identity, network, and IDS/IPS threat events
15Security-awareness participation and phishing-simulation results
16Incident-response contacts, escalation procedures, and exercise support
17Available TPSP compliance-status and shared-responsibility information
18Service reviews, exceptions, remediation tracking, and operational performance records

Coverage key

What each label means.

Strong

Network Box can directly deliver and operate a substantial part of this technical outcome when the relevant services are in scope.

Partial

Network Box contributes meaningful controls, but the requirement also depends on the client's systems, configuration, people, or processes.

Supporting

Network Box provides useful security operations or evidence, but does not satisfy the requirement by itself.

Client responsibility

This area primarily remains with the MSP and client, their assessors, or other qualified parties.

Shared responsibility

Network Box helps operate the controls. The organization owns the compliance program.

The merchant or service provider owns PCI applicability, payment channels and account-data flows, annual scope confirmation, stored-data protection, enterprise identity and physical controls, secure development, remediation, required scanning and penetration testing, third-party governance, incident obligations, evidence completeness, and accurate SAQ, AOC, ROC, or other validation submissions.

PCI DSS v4.0.1 FAQ

Questions about scope, evidence, and responsibility.

What is PCI DSS v4.0.1?

Bring current PCI DSS requirements into continuous managed operation across a correctly scoped cardholder data environment.

How can Network Box USA support PCI DSS v4.0.1?

Network Box USA can operate managed technical safeguards, monitor the subscribed environment, investigate and escalate security activity, maintain managed configurations, and produce service evidence that may support applicable PCI DSS v4.0.1 requirements.

Does using Network Box USA make an organization PCI DSS v4.0.1 compliant?

No. A managed security service can contribute controls, operations, and evidence, but it cannot guarantee compliance or replace the organization's governance, complete scope, legal interpretation, assessment, or formal certification and attestation work.

How should the PCI DSS v4.0.1 control mapping be used?

Use the mapping as a scoping and evidence-planning aid. Each row explains the requirement, the potential Network Box contribution, available evidence, the coverage level, and the work that remains with the organization.

What evidence may be available for a PCI DSS v4.0.1 assessment?

Depending on the deployed services and agreed retention, evidence may include managed configurations, logs, alerts, incident records, vulnerability findings, change records, service reports, and recurring operational reviews. The assessor determines whether evidence is sufficient.

What remains the organization's responsibility under PCI DSS v4.0.1?

Important information

Compliance and legal disclaimer

The information in this Compliance Center is provided for general informational purposes and does not constitute legal, regulatory, audit, or certification advice. Requirements vary by organization, jurisdiction, contract, data, and system scope. Network Box services can support selected technical and operational safeguards but do not by themselves establish compliance, certification, or attestation. Each organization remains responsible for determining its obligations, defining scope, implementing governance and non-technical controls, and obtaining advice or assessment from qualified legal, compliance, audit, or certification professionals.

Explore another frameworkReturn to the Compliance Center →

Security stack review

Map the technical foundation before the assessment starts.

Request a Security Stack Review