PCI DSS v4.0.1
Asked for your PCI DSS attestation? Start here.
For firms that take card payments on the cloud and have been asked for an Attestation of Compliance. The platform shows what is in scope, what your assessor will ask for under each requirement and where you fall short, before the assessment starts.
Normatiq does not perform PCI DSS assessments or issue Reports on Compliance. Your QSA does.
Where firms on a cloud fall short
Five requirements firms miss most.
For each one, what an assessor asks to see. Chosen by a practitioner who has led PCI DSS assessments since 2018.
| Requirement | What it asks for | What an assessor asks to see |
|---|---|---|
| 12.5.2 | Scope is documented and confirmed every 12 months, and after a significant change | A dated scope document: the data flows, and every system in the cardholder data environment, connected to it, or able to affect its security. |
| 1.2.5 | Allowed services, protocols and ports are identified and approved | The list of what is allowed, who approved each entry and the business reason for it. |
| 8.4.2 | Multi-factor authentication (MFA) for all non-console access into the cardholder data environment | Proof that non-console access into the environment asks for a second factor, for all personnel and not only administrators. |
| 10.4.1.1 | Audit logs are reviewed by automated means | The tool that reviews the logs, what it alerts on, and a recent alert that was followed up. |
| 11.6.1 | Changes to payment pages are detected and reported | What watches the payment page as the customer's browser receives it, how often it runs and who gets the alert. |
Scope comes first
Scope mistakes that surface late.
Scope decides how much of the standard applies to you.
| The mistake | What the standard expects | Requirement |
|---|---|---|
| Connected systems left out | Admin access, deployment tooling, logging and identity are in scope even when no card data passes through them. | 12.5.2 |
| The cloud provider assumed to cover it | You need a record of which requirements are theirs, which are yours and which are shared. | 12.8.5 |
| Segmentation claimed but not tested | The separation is tested at least once every 12 months and after any change to it. | 11.4.5 |
Evidence
Why evidence gets sent back.
Three reasons evidence comes back in the first round.
| Why it comes back | What to do |
|---|---|
| It does not cover the scope | Check each item against your scope: every account and every environment the requirement applies to. |
| It has no date or source | Capture the date, the system and the account with every screenshot and export. |
| It is a policy with no proof | Pair each policy with a record of it being followed: a ticket, a log entry, a dated review. |
How you are validated
ROC or SAQ: who decides?
Not you, and not the standard. The card schemes decide, and whoever asks for your validation, such as your acquirer.
The platform is built for the first and also serves the second.
- Report on Compliance (ROC)
- A QSA, the assessor many firms call their auditor, assesses you and writes the report
- Self-assessment questionnaire (SAQ)
- You assess yourself
- Either way
- You hand over an Attestation of Compliance
The standard
The twelve requirements, in plain words.
Each one breaks down into numbered requirements such as 8.4.2. The platform reports against those numbers.
- Network security controls in place and maintained
- Secure configuration of every system component
- Stored account data protected
- Cardholder data encrypted when sent over open, public networks
- Systems and networks protected from malicious software
- Systems and software developed and maintained securely
- Access limited to those whose job needs it
- Users identified and access authenticated
- Physical access to cardholder data restricted
- Access to systems and cardholder data logged and monitored
- Security of systems and networks tested regularly
- Information security backed by policy and programmes
Version 4.0 was retired on 31 December 2024. The future-dated requirements took effect on 31 March 2025 (sources 3 and 4).
Guides
Questions firms ask before the audit.
Each guide answers one question, with its sources and the date they were last read.
- PCI DSS for UK e-money and payment institutionsChecked 13 Oct 2026
PCI DSS applies to a UK e-money or payment institution that handles card data or can affect its security. It is enforced by contract, not by the FCA.
- PCI DSS ROC or SAQ: which do you need?Checked 13 Oct 2026
A Report on Compliance (ROC) is an assessor's report. A self-assessment questionnaire (SAQ) is your own. Your acquirer or the card schemes decide which.
- Scripts on payment pages: PCI DSS 6.4.3 and 11.6.1Checked 13 Oct 2026
PCI DSS 6.4.3 and 11.6.1 cover scripts on payment pages. Authorise and list every script; detect changes to scripts and headers. Both apply since 31 March 2025.
- Your cloud is PCI DSS compliant. Are you?Checked 13 Oct 2026
A cloud provider's PCI DSS attestation covers its own services, not what you build on them. What stays with you, and the evidence your assessor asks for.
Sources
- PCI Security Standards Council, PCI DSS v4.0.1 Report on Compliance Template, revision 3, January 2025, in the document library. Read 13 Oct 2026
- PCI Security Standards Council, PCI DSS v4.x Quick Reference Guide, January 2025, in the document library. Read 13 Oct 2026
- PCI Security Standards Council, Just Published: PCI DSS v4.0.1, 11 June 2024. Read 13 Oct 2026
- PCI Security Standards Council, Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x, 20 August 2024. Read 13 Oct 2026
The Council's wording is paraphrased and cited by requirement number. The twelve requirements are in our own wording. The standard itself is in the Council's document library.
See it on your own scope.
Ask for a walkthrough and we will show you the platform against a scope like yours.
The button opens an email to info@normatiq.io.