← All templates

PCI DSS 4.0

Payment Card Industry Data Security Standard. Covers security of cardholder data environments.

27 questions·Version 4.0
Use this template free

Network Security

  • Do you maintain network security controls (firewalls) around the cardholder data environment?Req.1
  • Is the cardholder data environment segmented from other networks?Req.1
  • Are network diagrams maintained and kept up to date?Req.1

Secure Configuration

  • Do you apply secure configurations to all system components?Req.2
  • Are default passwords always changed before system deployment?Req.2
  • Is unnecessary software and functionality removed from systems?Req.2

Cardholder Data Protection

  • Do you minimise storage of cardholder data?Req.3
  • Is stored cardholder data encrypted using strong cryptography?Req.3
  • Is the full PAN (primary account number) masked when displayed?Req.3
  • Is cardholder data transmitted over open networks encrypted?Req.4

Vulnerability Management

  • Is anti-malware software deployed on all applicable systems?Req.5
  • Are systems and software protected against known vulnerabilities?Req.6
  • Are security patches applied within defined timeframes?Req.6
  • Do you conduct internal and external vulnerability scans quarterly?Req.11
  • Do you conduct annual penetration testing of the cardholder data environment?Req.11

Access Control

  • Is access to system components restricted to only those with a legitimate business need?Req.7
  • Is a unique ID assigned to each person with computer access?Req.8
  • Is multi-factor authentication used for all access to the cardholder data environment?Req.8
  • Is physical access to the cardholder data environment restricted and logged?Req.9

Monitoring

  • Are all access to system components and cardholder data logged?Req.10
  • Are audit logs reviewed daily for anomalies?Req.10
  • Are logs protected from modification and retained for at least 12 months?Req.10

Security Policy

  • Do you maintain an information security policy covering PCI DSS requirements?Req.12
  • Do you conduct annual security awareness training covering PCI DSS?Req.12
  • Are third-party service providers who handle cardholder data contractually bound to PCI DSS?Req.12

Compliance

  • Do you hold a current PCI DSS compliance certification?Req.12
  • What is your current PCI DSS compliance level (SAQ or ROC)?Req.12

Send this questionnaire to your vendors

VendorAuditly automatically scores responses, maps answers to framework controls, and tracks coverage over time. Free to start.

Get started free →← All templates