Payment Security · Supported
PCI DSS v4.0
Payment Card Industry Data Security Standard v4.0
PCI DSS v4.0
PCI DSS v4.0 is explicit about identifying users, restricting administrative access and logging it. ZenXPAM seeds the standard and maps its controls to named requirements such as Requirement 7, 8 and 10, evidencing scoped, approved and recorded privileged access into the cardholder data environment.
- Requirement-level mapping for access control and logging
- Continuous automated checks with a PCI DSS v4.0 score and drill-down
- Access certification campaigns over CDE administrative accounts
- Hash-chained audit covering privileged session and command activity
What is PCI DSS v4.0?
PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Developed by the major credit card companies (Visa, MasterCard, American Express, Discover, and JCB), PCI DSS consists of 12 requirements organized into six control objectives: build and maintain a secure network, protect cardholder data, maintain a vulnerability management program, implement strong access control measures, regularly monitor and test networks, and maintain an information security policy. The standard requires organizations to encrypt cardholder data, restrict access to cardholder data, regularly test security systems, and maintain policies that address information security. PCI DSS compliance is mandatory for any organization that handles payment card data, with requirements varying based on the volume of transactions processed.
Where is PCI DSS v4.0 applicable?
PCI DSS compliance is mandatory for all organizations that accept, process, store, or transmit payment card data, regardless of size or transaction volume. This includes merchants (retail stores, e-commerce websites, restaurants, hotels), payment processors, financial institutions, service providers that handle cardholder data, and any third-party vendors that store, process, or transmit cardholder data on behalf of merchants. The standard applies to all payment channels, including in-person transactions, e-commerce, mail order, telephone order, and mobile payments. PCI DSS requirements vary based on the number of transactions processed annually, with four levels of compliance. Level 1 applies to merchants processing over 6 million transactions annually, while smaller merchants fall into Levels 2-4. All organizations, regardless of level, must comply with PCI DSS requirements. Non-compliance can result in significant fines, increased transaction fees, and loss of ability to accept credit card payments.
Features, benefits & risks
Key Features
- Requirement-level mapping for access control and logging
- Continuous automated checks with a PCI DSS v4.0 score and drill-down
- Access certification campaigns over CDE administrative accounts
- Hash-chained audit covering privileged session and command activity
- Signed evidence packs with an offline verifier for your QSA
Benefits
- Evidences restricted, justified administrative access to the CDE
- Replaces shared admin credentials with vaulted, injected access
- Supports the v4.0 move toward continuous control operation
- Gives the QSA artefacts that do not depend on platform trust
- Reduces evidence gathering ahead of the annual assessment
Risks
- Fines ranging from $5,000 to $100,000 per month for non-compliance
- Loss of ability to accept credit card payments
- Increased transaction fees and penalties from payment processors
- Data breaches exposing cardholder information leading to fraud
- Legal liability and financial losses from payment card fraud