PCI DSS 4.0, all year long.
Version 4.0 treats PCI DSS security as an ongoing process. TruOps keeps your evidence ongoing too.
PCI DSS 4.0 results
Report on Compliance results for each requirement’s sub-requirements
The same work also counts toward
Mapped coverage, with partial overlaps shown
Each mapping is labeled exact, partial, or inferred, with a source.
The Payment Card Industry Data Security Standard (PCI DSS) is maintained by the PCI Security Standards Council and applies to any entity that stores, processes, or transmits cardholder data. It has 12 principal requirements. Version 4.0.1 is current. Version 3.2.1 was retired in March 2024, and requirements that were future-dated in 4.0 became mandatory on 31 March 2025. Compliance is validated with a Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ).
- Maintained by
- PCI Security Standards Council
- Current version
- v4.0.1
- Requirements
- 12 principal requirements
- Validation
- ROC (by a QSA) or SAQ
The 12 requirements
- 1. Install and maintain network security controls
- 2. Apply secure configurations to all system components
- 3. Protect stored account data
- 4. Protect cardholder data with strong cryptography during transmission
- 5. Protect all systems and networks from malicious software
- 6. Develop and maintain secure systems and software
- 7. Restrict access to system components and cardholder data by business need to know
- 8. Identify users and authenticate access
- 9. Restrict physical access to cardholder data
- 10. Log and monitor all access to system components and cardholder data
- 11. Test security of systems and networks regularly
- 12. Support information security with organizational policies and programs
The challenge
PCI DSS 4.0 treats security as an ongoing process. Teams that only collect evidence in the month before the QSA visit can pass the checklist and still fall short.
- Targeted risk analyses are supposed to set how often you test, and they were only done once.
- Scope changes with every new store, site, and payment flow, and the ROC falls behind.
- Requirement 12.8 (service providers) is really a vendor program, and it runs on email.
What you're probably using today
Almost nobody starts PCI DSS 4.0 from scratch. You already have a program somewhere, and TruOps picks up from there.
| What you use now | Where it falls short | With TruOps |
|---|---|---|
| Spreadsheets, shared drives, and email | Your program lives in folders named after last year's audit. Owners paste screenshots the week before fieldwork, and nothing is dated, so you can't show what was true last quarter. | Upload those same files. TruOps pre-fills the assessment from them, cites every answer, and keeps technical checks running so you have evidence for the whole period. |
| SOC 2 automation tools | Great for getting certified, with automated tests, a big framework library, and often a trust center. Maturity scoring, custom frameworks, and deeper risk or vendor work can fall outside what they cover. | Keep your automated checks. Use any framework as your anchor, map the rest with partial overlaps clearly marked, and run vendor and risk work in the same place. Start with the policies and reports you already have. |
| Enterprise GRC suites | They can model almost anything, but that flexibility usually runs through implementation partners and admins, so every change turns into a project. | AI reads your existing documents and sets up the program. Your first assessment opens pre-filled with sources, and you make changes by asking in plain language. |
What 4.0 changed
Version 4.0 introduced a customized approach for meeting requirements, targeted risk analyses to set how often some activities happen, stronger authentication requirements, and more emphasis on security as an ongoing process. The future-dated requirements became mandatory on 31 March 2025.
How TruOps helps with PCI DSS
Pick PCI DSS as your anchor, or map it to the framework you already run. TruOps keeps PCI DSS's own structure, down to the individual requirement, and shows coverage per requirement as satisfied, partial, or open, with the evidence behind each.
Upload what you have (prior reports, policies, spreadsheets) and TruOps pre-fills your PCI DSS assessment with cited answers. Connected tools keep technical controls current on the schedule you set, and failed checks become findings with a recommended fix.
How TruOps helps
- Anchor or map
- Use PCI DSS as your anchor or map it to another framework, and your work counts once.
- Pre-filled assessment
- Your PCI DSS assessment opens with the answers your evidence supports already filled, each cited.
- Accurate coverage
- Partial coverage is clearly marked, with the remaining requirements listed.
- Continuous monitoring
- Technical controls checked against your tools, from hourly to quarterly.
- Findings with fixes
- Failed checks become grouped findings with a recommended action.
- Audit-ready snapshots
- Results saved as of their date, with the evidence trail attached.
Questions
What is the current version of PCI DSS?
Version 4.0.1. Version 3.2.1 was retired on 31 March 2024, and the future-dated requirements in 4.0 took effect on 31 March 2025.
What is the difference between a ROC and an SAQ?
A Report on Compliance is completed by a Qualified Security Assessor for larger merchants and service providers. A Self-Assessment Questionnaire is completed by eligible smaller entities themselves.
Can TruOps certify PCI compliance?
No. Validation comes from a QSA or your SAQ. TruOps prepares the assessment and keeps the evidence current.
Do we have to rip out the tools we already use?
No. TruOps connects to your cloud, identity, endpoint, vulnerability, and code tools. Spreadsheets, prior reports, and policies upload into the Data Room. If you're moving from a SOC 2 automation tool or an enterprise GRC suite, you bring over your frameworks, evidence, vendors, and risks.
Can we bring our existing assessments, control lists, and vendor files?
Yes. Upload workbooks, reports, policies, and vendor exports. TruOps turns them into structured questionnaires, controls, and risks, each linked to the file it came from, for you to review.
Does TruOps replace our auditor, QSA, or certification body?
No. Only a licensed auditor, QSA, C3PAO, or accredited certification body can issue the opinion. TruOps keeps your evidence current, sourced, and dated so fieldwork goes quickly.
Related
PCI DSS, consumer privacy, and a large supplier base.
→IndustriesFinancial servicesOverlapping regulations, heavy vendor oversight, and examiners who want proof.
→Use casesContinuous complianceStatus that reflects today.
→PlatformControl testingEvery control tested continuously, with verified tests for your tools and AI-written tests for the rest.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.