Free Download · PCI DSS 4.0
Walk into your next PCI assessment with the same checklist your QSA reads from. All 12 PCI DSS 4.0.1 requirements, every one of the 32 future-dated controls now in force since March 2025, the new Targeted Risk Analysis methodology, the Customized Approach option, and a CDE scoping + segmentation worksheet. Built by RiskWatch's compliance team for Level 1 merchants, service providers, and SaaS platforms storing or transmitting cardholder data.
Free PDF + Excel evidence tracker · No credit card · No sales call
Trusted by Level 1 merchants, service providers, and SaaS platforms managing PCI DSS 4.0, CDE scoping, TRA, and ROC + SAQ validation across every payment channel.
What's Inside the Checklist
PCI DSS 4.0 organizes the 12 numbered requirements under six control objectives. The checklist follows that structure exactly so every line maps 1:1 to what your QSA assesses. Sub-items below are a representative slice, the download contains the full set with evidence prompts.
Network security controls and secure configuration baselines for every system component touching the cardholder data environment.
PAN protection at rest and in transit. Cryptographic key management, retention limits, and the new disk-level vs application-level encryption distinctions.
Anti-malware, secure software development, payment-page script management, and the new HTTP request validation control for e-commerce environments.
Role-based access, identity + authentication including MFA for all CDE access, and physical security controls for any environment housing CHD.
Audit logging, automated review, segmentation pen-testing, ASV scans, and the new authenticated-internal-vulnerability-scan and IDS-tampering-detection requirements.
Information security policy, organizational risk analysis, third-party service-provider management, incident response, and the new Targeted Risk Analysis program.
PCI DSS 4.0 phased in 32 forward-looking sub-requirements with a 'best practice until' date of March 31, 2025. As of that date, every assessment must validate them. The checklist marks each one inline with implementation guidance and evidence prompts. Highlights:
Why Use This Checklist
PCI DSS 4.0.1 (June 2024) is the current version. The Council issued 4.0.1 as a minor revision, no new requirements, just clarifications and corrections, but it locks in every shift introduced in 4.0: 12 numbered requirements expanded to 64 sub-requirements, the 32 future-dated controls phased in by March 31, 2025, and the formal Targeted Risk Analysis (TRA) methodology. The checklist tracks the current 4.0.1 control set with each future-dated item flagged so you can confirm coverage before your next assessment.
DSS 4.0 added flexibility, and documentation overhead. The Targeted Risk Analysis lets you justify customer-defined frequencies for 18 controls (anti-malware, vulnerability scans, access reviews) instead of accepting a one-size cadence. The Customized Approach lets you meet a control's objective via alternative means with a formal TRA. Both are powerful for legacy infrastructure but require explicit, structured documentation. The checklist includes a TRA template and a Customized Approach worksheet so you don't reverse-engineer the documentation requirements weeks before your QSA visit.
Cardholder Data Environment scoping is the highest-leverage move you make. Smaller CDE = fewer §3 requirements on fewer systems = lower assessment cost and faster remediation. The checklist ships with a CDE scoping worksheet covering cardholder-data flow mapping, the §1.2.1 + §1.2.4 segmentation evidence checklist, the §11.4.5 segmentation pen-test cycle, and the connected-system inventory template. Most merchants over-PCI-treat their network because they don't have the segmentation map. Start there.
Who It's For
Level 1 merchants + service providers
Owning the QSA relationship, the ROC validation cycle, the SAQ submissions, and the acquirer reporting. The checklist gives you a structured pre-flight review so the QSA opens with three findings instead of fourteen.
Owns CDE protection and DSS 4.0 technical controls
Mapping MFA universality (§8.3.6 + §8.4.2), payment-page script management (§6.4.3 + §11.6.1), automated audit-log review (§10.4.1.1), and authenticated internal scanning (§11.3.1.1) onto your existing security stack, without re-architecting around a single sub-requirement.
Storing or transmitting cardholder data
Tokenized payment flows, Stripe / Adyen / Braintree integrations, hosted payment pages, and SAQ A-EP / D-Service-Provider obligations. The checklist includes a script-inventory worksheet, an iframe / redirect / hosted-page architecture decision tree, and the SAQ-vs-ROC selector.
What's actually in the checklist, the 32 future-dated controls, CDE scoping coverage, SAQ vs ROC, and how it cross-maps to ISO 27001 and SOC 2.
Run It On One Platform
Run PCI + ISO + SOC 2 on one platform
If you're past the checklist stage and ready to operationalize, RiskWatch runs continuous PCI DSS 4.0.1 + ISO 27001:2022 + SOC 2 Type 2 scoring against a single shared evidence vault. 30-minute walkthrough, no slideware, no consulting upsell.
Or call US: +1 401 884 5236
