PCI DSS v4.0 Quarterly Compliance Checklist [FREE PDF]

PCI DSS v4.0, effective March 2024, mandates quarterly reviews of network security controls, vulnerability scans, and access management for all entities storing, processing, or transmitting cardholder data. Requirement 11.3.2 requires quarterly external vulnerability scans by an Approved Scanning Vendor (ASV), while Requirement 8 governs authentication and access controls reviewed each quarter. Failure to maintain quarterly compliance evidence can result in fines, increased transaction fees, or

  • Industry: Compliance
  • Frequency: Quarterly
  • Estimated Time: 60-90 minutes
  • Role: Compliance Manager
  • Total Items: 34
  • Compliance: PCI DSS v4.0 Requirement 6.3.3, PCI DSS v4.0 Requirement 8.2.1, PCI DSS v4.0 Requirement 11.3.2, NIST CSF 2.0 ID.RA-1, ISO 27001:2022 Annex A 8.8

Network Security Controls

Verify firewalls, network segmentation, and perimeter defenses protecting the cardholder data environment (CDE).

  • Are all firewall and router rule sets reviewed and approved within the last quarter?
  • Is network segmentation between the CDE and out-of-scope networks validated and documented?
  • Are all inbound and outbound traffic flows restricted to only what is necessary for the CDE?
  • Is a network diagram current and reflecting all connections to the CDE?
  • Are wireless access points within or connected to the CDE inventoried and tested for rogue devices this quarter?

Vulnerability Management & Patching

Confirm that vulnerability scanning, patch management, and risk remediation meet quarterly PCI DSS obligations.

  • Has a quarterly external vulnerability scan been completed by an ASV and passed without critical findings?
  • Has an internal vulnerability scan been performed this quarter and all high-risk findings remediated?
  • Are all critical security patches applied within one month of release across CDE systems?
  • Is a formal risk ranking methodology applied to newly discovered vulnerabilities?
  • Are web-facing applications protected by a WAF or subjected to code review each quarter?

Access Control & Authentication

Review user access rights, multi-factor authentication, and privileged account governance for CDE systems.

  • Has a formal access review been conducted for all CDE user accounts this quarter?
  • Is multi-factor authentication (MFA) enforced for all non-console administrative access to the CDE?
  • Are shared or generic accounts prohibited or documented with justification for all CDE systems?
  • Are terminated employee accounts removed or disabled within 24 hours of termination?
  • Is the principle of least privilege applied and verified for all CDE user roles this quarter?

Logging & Monitoring

Ensure audit logs are generated, retained, and reviewed daily to detect anomalous activity in the CDE.

  • Are audit logs generated for all CDE components, including all administrative actions?
  • Are logs reviewed at least daily through automated tools or manual processes?
  • Are logs retained for at least 12 months, with three months immediately available?
  • Are log integrity controls in place to prevent unauthorized modification or deletion?
  • Is a SIEM or centralized log management solution in use for CDE systems?

Cardholder Data Protection

Verify encryption, masking, and data discovery controls protecting stored and transmitted cardholder data.

  • Is a data discovery scan performed this quarter to identify unintended cardholder data storage locations?
  • Is primary account number (PAN) data encrypted at rest using strong cryptography (AES-256 or equivalent)?
  • Is all cardholder data transmitted over open, public networks encrypted using TLS 1.2 or higher?
  • Are encryption key management procedures documented and keys rotated per defined policy?
  • Is sensitive authentication data (SAD) such as CVV or full track data confirmed not to be stored post-authorization?

Third-Party & Vendor Risk

Assess service provider agreements, compliance status, and access controls for third parties with CDE access.

  • Is an up-to-date list of all third-party service providers (TPSPs) with CDE access maintained?
  • Do all TPSPs acknowledge their PCI DSS responsibilities in a written agreement?
  • Has each TPSP's PCI DSS compliance status been verified within the last year?
  • Is TPSP access to the CDE monitored and limited to the minimum necessary?

Incident Response Readiness

Confirm incident response plan currency, staff training, and quarterly testing of response procedures.

  • Is the incident response plan reviewed and updated within the last 12 months?
  • Has incident response training been completed by all relevant personnel this year?
  • Are contact lists for card brands and acquiring banks current in the incident response plan?
  • Were any security incidents detected and formally documented in this quarter?
  • If incidents occurred this quarter, were they remediated and root-cause analyses completed?

Related Cybersecurity Compliance Checklists

Related Compliance Audit Checklists

Why Use This PCI DSS v4.0 Quarterly Compliance Checklist [FREE PDF]?

This pci dss v4.0 quarterly compliance checklist [free pdf] helps compliance teams maintain compliance and operational excellence. Designed for compliance manager professionals, this checklist covers 34 critical inspection points across 7 sections. Recommended frequency: quarterly.

Ensures compliance with PCI DSS v4.0 Requirement 6.3.3, PCI DSS v4.0 Requirement 8.2.1, PCI DSS v4.0 Requirement 11.3.2, NIST CSF 2.0 ID.RA-1, ISO 27001:2022 Annex A 8.8. Regulatory-aligned for audit readiness and inspection documentation.

Frequently Asked Questions

What does the PCI DSS v4.0 Quarterly Compliance Checklist [FREE PDF] cover?

This checklist covers 34 inspection items across 7 sections: Network Security Controls, Vulnerability Management & Patching, Access Control & Authentication, Logging & Monitoring, Cardholder Data Protection, Third-Party & Vendor Risk, Incident Response Readiness. It is designed for compliance operations and compliance.

How often should this checklist be completed?

This checklist should be completed quarterly. Each completion takes approximately 60-90 minutes.

Who should use this PCI DSS v4.0 Quarterly Compliance Checklist [FREE PDF]?

This checklist is designed for Compliance Manager professionals in the compliance industry. It can be used for self-assessments, team audits, and regulatory compliance documentation.

Can I download this checklist as a PDF?

Yes, this checklist is available as a free PDF download. You can also use it digitally in the POPProbe mobile app for real-time data capture, photo documentation, and automatic reporting.

Browse More Checklists