Free tool · No sign-in required

PCI DSS v4.0.1 Audit Checklist

Interactive checklist covering all 12 PCI DSS v4.0.1 requirements. Filter by SAQ type, check off controls as you verify them, and export results to clipboard. Progress auto-saves in your browser.

Not sure which SAQ you need? ·AI gap assessor ·QSA interview

Progress—

Filter by SAQ type

1.1.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Network security control (NSC) policies and standards are defined and implemented.

1.1.2

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Roles and responsibilities for NSCs are documented, assigned, and understood.

1.2.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Configuration standards for NSCs restrict inbound/outbound traffic to necessary only.

1.2.2

SAQ-B-IPSAQ-CSAQ-D

NSC configurations are reviewed at least once every six months.

1.3.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Inbound traffic to the CDE is restricted to that which is necessary.

1.3.2

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Outbound traffic from the CDE is restricted to that which is necessary.

1.4.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

NSCs are installed between trusted and untrusted networks.

1.5.1

SAQ-A-EPSAQ-D

Security controls are implemented on devices connecting from untrusted networks.

2.1.1

All SAQs

Configuration policies and standards are defined and implemented for all components.

2.1.2

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Roles and responsibilities for secure configurations are assigned and understood.

2.2.1

All SAQs

Configuration standards address all known security vulnerabilities per vendor guidance.

2.2.2

All SAQs

Vendor default accounts are managed; defaults are changed before installation.

2.2.3

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

All non-console administrative access is encrypted using strong cryptography.

2.2.4

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Only necessary services, protocols, and ports are enabled; insecure ones are removed.

2.3.1

SAQ-D

Wireless environments connected to or transmitting CHD use industry best practices.

2.3.2

SAQ-D

Wireless vendor defaults are changed prior to installation of wireless networks.

3.1.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Policies and procedures for stored account data protection are defined and implemented.

3.2.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Account data storage is kept to a minimum through data retention and disposal policies.

3.3.1

SAQ-A-EPSAQ-CSAQ-D

SAD (sensitive authentication data) is not retained after authorization.

3.4.1

SAQ-D

PAN is masked when displayed; only personnel with a legitimate need see full PAN.

3.5.1

SAQ-D

PAN is secured with strong cryptography if stored (disk encryption or token).

3.6.1

SAQ-D

Key management procedures and processes for cryptographic keys are documented.

3.7.1

SAQ-D

Cryptographic key management policies cover key generation and distribution.

4.1.1

All SAQs

Policies for protecting CHD during transmission over open public networks are defined.

4.2.1

All SAQs

Strong cryptography (TLS 1.2+) is used to safeguard PAN during transmission.

4.2.1.1

SAQ-A-EPSAQ-CSAQ-D

An inventory of trusted keys and certificates used to protect PAN in transit is maintained.

4.2.1.2

SAQ-D

Wireless networks transmitting PAN use strong cryptography for authentication and transmission.

4.2.2

SAQ-D

PAN is secured with strong cryptography when sent via end-user messaging technologies.

5.1.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Anti-malware policies and procedures are defined, assigned, and understood.

5.2.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

An anti-malware solution is deployed on all systems commonly affected by malware.

5.2.2

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Anti-malware solutions detect all known types of malware and protect against them.

5.2.3

SAQ-D

Systems not commonly affected are evaluated periodically for evolving malware threats.

5.3.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Anti-malware solutions are kept current via automatic updates.

5.3.2

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Anti-malware solutions perform periodic or continuous scans of system components.

5.4.1

SAQ-D

Phishing protection mechanisms are in place to detect and protect against phishing attacks.

6.1.1

All SAQs

Policies for developing and maintaining secure systems and software are defined.

6.2.1

SAQ-A-EPSAQ-D

Bespoke and custom software are developed securely per a software development lifecycle.

6.2.4

SAQ-A-EPSAQ-D

Software engineers are trained to prevent common vulnerabilities (OWASP Top 10).

6.3.1

All SAQs

Security vulnerabilities are identified and managed using a vulnerability management process.

6.3.2

SAQ-A-EPSAQ-D

An inventory of all bespoke and third-party software components is maintained.

6.3.3

All SAQs

All software components are protected from known vulnerabilities by applying patches.

6.4.1

SAQ-ASAQ-A-EPSAQ-D

Web-facing applications are protected against known web-based attacks.

6.4.2

SAQ-ASAQ-A-EPSAQ-D

An automated technical solution detects and prevents web-based attacks continuously.

6.4.3

SAQ-ASAQ-A-EPSAQ-D

All payment page scripts loaded and executed in the consumer browser are managed.

7.1.1

All SAQs

Access control policies are defined, communicated, and enforced.

7.2.1

All SAQs

Access to system components and data is appropriately defined and assigned.

7.2.2

All SAQs

Access is assigned based on least privilege and business need to know.

7.2.3

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Required privileges are approved by authorized personnel.

7.2.4

All SAQs

All user accounts and related access privileges are reviewed at least every six months.

7.3.1

SAQ-D

An access control system is in place that restricts access based on a user's need to know.

8.1.1

All SAQs

Policies for user identification and authentication are defined and implemented.

8.2.1

All SAQs

All users are assigned a unique ID before access to system components or CHD is allowed.

8.2.4

All SAQs

Invalid authentication attempts are limited to no more than 10 attempts before lockout.

8.3.1

All SAQs

User passwords/passphrases meet a minimum length of at least 12 characters.

8.3.6

All SAQs

Passwords/passphrases used for MFA factors meet PCI DSS password requirements.

8.4.1

All SAQs

MFA is implemented for all non-console access to the CDE for personnel.

8.4.2

All SAQs

MFA is implemented for all access to the CDE.

8.5.1

All SAQs

MFA systems are implemented to prevent replay attacks and cannot be bypassed by any user.

8.6.1

SAQ-D

System/application accounts and related authentication factors are managed per policies.

9.1.1

SAQ-BSAQ-B-IPSAQ-CSAQ-D

Policies for restricting physical access to CHD are defined and implemented.

9.2.1

SAQ-D

Appropriate facility entry controls are in place to restrict physical access to the CDE.

9.3.1

SAQ-D

Physical access to sensitive areas is controlled and monitored for authorized personnel.

9.4.1

SAQ-D

All media with cardholder data is physically secured.

9.4.2

SAQ-D

All media with cardholder data is classified in accordance with data classification.

9.4.3

SAQ-D

Media with cardholder data sent outside the facility is secured and logged.

9.5.1

SAQ-BSAQ-B-IPSAQ-CSAQ-D

POI devices that capture payment card data are protected from tampering and substitution.

9.5.1.2

SAQ-BSAQ-B-IPSAQ-CSAQ-D

An inventory of POI devices is maintained, reviewed, and updated periodically.

10.1.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Policies for logging and monitoring all access to system components are defined.

10.2.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Audit logs are enabled and active for all system components in scope.

10.2.1.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Audit logs capture all individual user access to cardholder data.

10.3.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Read access to audit log files is limited to those with a job-related need.

10.3.2

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Audit log files are protected to prevent modifications by individuals.

10.4.1

SAQ-D

Audit logs are reviewed at least once daily for all system components in scope.

10.5.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Retain audit log history for at least 12 months (3 months immediately available).

10.7.1

SAQ-D

Failures of critical security controls are detected, reported, and responded to promptly.

11.1.1

All SAQs

Policies for testing security of systems and networks are defined and implemented.

11.2.1

SAQ-D

Authorized and unauthorized wireless access points are managed and detected quarterly.

11.3.1

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

Internal vulnerability scans are performed and addressed at least once every three months.

11.3.2

All SAQs

External vulnerability scans are performed by a PCI SSC Approved Scanning Vendor (ASV).

11.4.1

SAQ-D

A penetration testing methodology is defined, documented, and implemented.

11.4.2

SAQ-D

Internal penetration testing is performed at least once every 12 months.

11.4.3

SAQ-A-EPSAQ-BSAQ-B-IPSAQ-CSAQ-D

External penetration testing is performed at least once every 12 months.

11.5.1

SAQ-D

Intrusion-detection or intrusion-prevention techniques detect or alert on covert malware.

11.6.1

SAQ-ASAQ-A-EPSAQ-D

A change- and tamper-detection mechanism alerts personnel to unauthorized modifications.

12.1.1

All SAQs

An overall information security policy is established, published, and reviewed annually.

12.1.2

All SAQs

The information security policy includes all PCI DSS requirements.

12.3.1

All SAQs

Each PCI DSS requirement is managed via targeted risk analyses where required.

12.5.2

All SAQs

PCI DSS scope is documented and confirmed at least once every 12 months.

12.6.1

All SAQs

A formal security awareness program is implemented for all personnel.

12.6.2

All SAQs

Security awareness training is reviewed at least once every 12 months.

12.8.1

All SAQs

A list of all third-party service providers (TPSPs) that share or affect CHD is maintained.

12.8.2

All SAQs

Written agreements are in place with all TPSPs acknowledging their PCI DSS responsibilities.

12.10.1

All SAQs

An incident response plan is in place to respond immediately to a system breach.

Based on PCI DSS v4.0.1 (March 2024). SAQ scoping reflects PCI SSC guidance; always confirm applicability with your QSA. This checklist is a self-assessment aid and does not constitute a formal compliance assessment.

PCI DSS v4.0.1 Audit Checklist

Practice & Coaching

Simulations

PCI DSS

Studios

Scanners & Library

Arcade

Stay Lowkey 🔒

Community

Get Started Free

Practice & Coaching

Simulations

PCI DSS

Studios

Scanners & Library

Arcade

Stay Lowkey 🔒

Community

Get Started Free