PCI DSS v4.0.1
PCI DSS for payment card data.
PCI DSS sets security requirements for organisations that store, process or transmit payment card data. With Basenorm you manage the requirements, controls and evidence on your ISO 27001 ISMS.
Hosted in the Netherlands. Your data stays in the EU.In brief
- Version
- PCI DSS v4.0.1The requirements that were future-dated in v4.0 apply since 31 March 2025
- Structure
- 12 requirementsGrouped in six goals
- Applies to
- Merchants and service providersThat store, process or transmit card data
- Validation
- ROC or SAQReport on Compliance by a QSA, or a self-assessment
01 / What PCI DSS asks
What PCI DSS
asks of you.
The twelve requirements are grouped in six goals. They apply to your cardholder data environment and the systems connected to it.
- 1Secure network and systems
Network security controls and secure configurations.
- 2Protect account data
Protect stored account data and encrypt it during transmission.
- 3Vulnerability management
Protect against malware and develop and maintain secure systems and software.
- 4Strong access control
Restrict access by business need, identify users and restrict physical access.
- 5Monitor and test networks
Log and monitor access, and test security regularly.
- 6Information security policy
Support information security with organisational policies and programmes.
02 / With your ISMS
PCI DSS on what you already have.
| Topic | Your ISO 27001 ISMS | What PCI DSS adds |
|---|---|---|
| Access | Access control and identity management | Specific requirements such as multi-factor authentication for access to the card data environment |
| Data protection | Cryptography controls | Requirements for storing and transmitting account data |
| Testing | Technical vulnerability management | Defined scanning and penetration testing requirements |
| Scope | ISMS scope | A defined cardholder data environment and segmentation |
ISO 27001 does not replace PCI DSS validation. Many controls can be reused, but PCI DSS sets more prescriptive requirements.
03 / The assessment
PCI SECURITY STANDARDS COUNCILHow PCI DSS
is assessed.
How you validate depends on your role and transaction volume, as set by the card brands and your acquirer.
Read about ISO 27001Report on Compliance. An assessment by a Qualified Security Assessor, for larger merchants and service providers.
Self-Assessment Questionnaire. A self-assessment for eligible merchants, depending on how they handle card data.
Attestation of Compliance. The declaration that accompanies the assessment.
PCI DSS is maintained by the PCI Security Standards Council.
04 / In Basenorm
How Basenorm supports you.
Unified Control Library
See which of your ISO 27001 controls also count for PCI DSS.
02Governance Graph
Connect systems in the card data environment, controls, evidence and owners.
03AskNorman
Ask what is still open for PCI DSS, in Basenorm or via MCP from ChatGPT, Claude or Perplexity. You review the evidence yourself.
05 / Questions
Questions about
PCI DSS.
Does PCI DSS apply to us?
If you store, process or transmit payment card data, or can affect the security of that data, it does. Your acquirer or the card brands determine how you validate.
Is ISO 27001 enough for PCI DSS?
No. Many controls overlap, but PCI DSS has its own, more prescriptive requirements and its own validation.
What changed in version 4?
Version 4.0 introduced new requirements, such as broader multi-factor authentication, and the option of a customised approach. The requirements that were future-dated apply since 31 March 2025.
Does Basenorm perform the assessment?
No. Basenorm helps you organise requirements, controls and evidence. The assessment is done by a Qualified Security Assessor or through a self-assessment.
Book a demo
Manage PCI DSS on your ISMS.
In a demo we look at your card data environment and what you can reuse.
- Which ISO 27001 controls count for PCI DSS.
- How you keep evidence per requirement.
- How you manage PCI DSS next to your other standards.
Hosted in the Netherlands. Your data stays in the EU.