PCI DSS v4.0: A Practical Compliance Guide for Card-Handling Businesses

Who PCI DSS applies to

PCI DSS applies to any entity that stores, processes or transmits cardholder data (CHD) or sensitive authentication data - merchants, processors, gateways, and service providers. Your merchant/service-provider level (1 to 4) determines whether you self-assess (SAQ) or need a QSA-led assessment.

In India, RBI-regulated banks, fintech platforms and payment aggregators typically need Level 1 PCI DSS - the most rigorous tier.

The 12 PCI DSS requirements (at a glance)

• Install and maintain network security controls
• Apply secure configurations to all system components
• Protect stored account data; encrypt transmission of cardholder data
• Protect systems against malware; develop secure systems and software
• Restrict access to data by business need-to-know; authenticate access
• Restrict physical access; log and monitor all access
• Test security of systems and networks regularly (including VAPT)
• Maintain an information-security policy and program

Scope, SAQ and QSA

The most important lever in PCI DSS is scope: minimizing the cardholder-data environment (CDE) through segmentation dramatically reduces cost and effort. Smaller merchants may validate via a Self-Assessment Questionnaire (SAQ); higher volumes and service providers need a Qualified Security Assessor (QSA)-led Report on Compliance.

PCI DSS v4.0 also requires segmentation penetration testing to prove that out-of-scope networks truly cannot reach the CDE.

Path to PCI DSS v4.0 compliance

• Map card flows and define/minimize the cardholder-data environment
• Run a gap analysis against PCI DSS v4.0
• Remediate controls; validate segmentation with a pentest
• Run required VAPT and ASV scans
• Support SAQ or QSA-led assessment and maintain evidence