Payment Card Industry Data Security Standard v4.0 compliance guide
Network security controls to protect cardholder data
Remove vendor defaults, harden all systems
Encryption, tokenization, data retention limits
Encryption for transmission over public networks
Anti-virus, anti-malware on all systems
Secure development lifecycle, vulnerability management
Need-to-know basis for cardholder data access
Unique IDs, strong authentication, MFA
Physical security for systems with cardholder data
Logging, monitoring, audit trails
Vulnerability scans, penetration testing
Security policy, awareness training, incident response
6M+ annually
Annual on-site assessment by QSA
1M - 6M
Annual Self-Assessment Questionnaire (SAQ)
20K - 1M
Annual SAQ
<20K
Annual SAQ
LowerPlane helps manage CDE scope, ASV scans, and continuous compliance monitoring
Book a Demo