Framework · PCI DSSPCI DSS v4.0.1

PCI DSS v4.0.1, with no surprises at your assessment.

Name: Compyl PCI DSS Compliance
Brand: Compyl
Availability: InStock

PCI DSS v4.0 introduced 51 future-dated requirements that have been mandatory since March 31, 2025, and the annual SAQ or ROC and quarterly scans never stop. Compyl’s PCI compliance software automates evidence for all 12 requirements, keeps your cardholder data scope tight, and flags gaps long before your QSA does.

Request a demo See how it works →

12 requirements125+ integrationsContinuous scoping

PCI DSS v4.0.1 · assessment readinessROC · 71 days · ASV scan due in 12

89%ready

Requirement evidence collected94%

Sub-requirements passing238 / 246

Evidence Health90

Req 1–2 NetworkReq 3–4 Account dataReq 5–6 VulnerabilityReq 7–9 Access · 1 driftingReq 10–12 Monitor & govern

Req 8.4.2 · MFA for all CDE accessEnforced via Okta for 212 users · refreshed 6 min ago

Passing

Req 7.2.4 · Six-monthly access reviewCampaign overdue for 2 CDE systems · task assigned to IT

Drift → task

CDE scope · 14 systems documented · 2 flagged as candidates for descopingScope current

The problem

v4.0’s new requirements are now assessed every year

PCI is an annual treadmill of SAQs, ROCs, and quarterly scans, and v4.0’s new requirements raised the bar. The gaps you can’t see become your assessor’s findings.

Scope creeps, evidence sprawls

Every new system that touches card data expands your cardholder data environment, and the evidence you must produce. Unmanaged, scope quietly balloons.

v4.0 requirements catch teams out

Targeted risk analyses, expanded MFA and anti-phishing: v4.0 added requirements many programs still haven’t fully operationalized.

The annual scramble repeats forever

A SAQ or ROC every year and scans every quarter. Without continuous evidence, each cycle is a manual rebuild from scratch.

How it works

One continuous loop, from connected systems to audit-ready

Compyl runs PCI as an always-on cycle, scope, controls, and evidence stay in sync automatically.

Connect

Integrate cloud, identity, code, endpoint, and HR systems.

Collect evidence

Pull audit evidence automatically, in real time.

Map to requirements

Link every artifact to its PCI DSS requirement.

Monitor

Watch controls continuously and flag drift early.

Stay audit-ready

Hand auditors a current evidence pack on demand.

The standard

12 requirements, six goals

PCI DSS organizes 12 requirements into six security goals. Compyl maps evidence to each requirement and keeps your cardholder data scope documented.

Secure network

Goal 1

Req 1–2

Install and maintain network security controls and secure configurations everywhere card data flows.

Firewalls · secure configs

Protect account data

Goal 2

Req 3–4

Protect stored cardholder data and encrypt it in transit across open, public networks.

Storage · transit encryption

Vulnerability management

Goal 3

Req 5–6

Protect against malware and develop and maintain secure systems and software.

Anti-malware · secure dev

Strong access control

Goal 4

Req 7–9

Restrict access by need-to-know, authenticate every user, and control physical access.

Need-to-know · MFA · physical

Monitor & govern

Goals 5–6

Req 10–12

Log and monitor all access, test security regularly, and maintain an information-security policy.

Logging · testing · policy

Automated evidence

Stop assembling PCI evidence by hand

The cost of PCI isn’t the assessment fee, it’s the weeks spent gathering proof for all 12 requirements across your cardholder data environment. Compyl collects it continuously and maps it to each requirement.

Pull evidence automatically from cloud, identity, code, and endpoint tools
Every artifact mapped to the PCI DSS requirement it supports
No more screenshots, spreadsheets, or last-minute requests
Export a complete, auditor-ready evidence pack on demand

Requirement evidence · collected automatically1,190 artifacts · live

AWS · security groups, KMS, CloudTrail402 artifacts · mapped to Req 1, 3, 10

Synced 2m

Okta · users, MFA, sessions221 artifacts · mapped to Req 7, 8

Synced 5m

Qualys · vulnerability scans168 artifacts · mapped to Req 6, 11

Synced 20m

CrowdStrike · anti-malware131 artifacts · mapped to Req 5

Synced 4m

Every artifact mapped to the PCI DSS requirement it supportsQSA-ready pack

Evidence Health · New in 26.2

Know your evidence is audit-ready, automatically

Collecting evidence is only half the battle; stale or incomplete proof is where assessments go sideways. Evidence Health continuously scores every artifact the moment it changes, so weak evidence surfaces weeks before your QSA, not during fieldwork.

Every artifact scored on relevance, freshness, and completeness
An AI summary spells out exactly what’s missing and why
Re-scores automatically whenever the underlying evidence changes
Gaps surface with time to fix, not during the assessment

Evidence HealthNew in 26.2 · re-scores on change

ArtifactTargeted risk analysis · Req 12.3.1

Score54 / 100

RelevanceHigh

FreshnessStale · 11 months

AI summary · what’s missingReq 12.3.1 requires a targeted risk analysis for each requirement that allows a flexible frequency. Analyses exist for Req 5.2.3 and 8.6.3 but not for 9.5.1.2 (POI device inspections) or 11.6.1 (payment page change detection). Add both before the ROC fieldwork.

Create taskOpen risk register

Weak evidence surfaces weeks before your QSA, not during fieldworkScored continuously

Continuous monitoring

Catch control drift before your QSA does

Your SAQ is a snapshot; PCI risk lives in the other 364 days. Compyl monitors every requirement continuously and turns the moment a control slips into a tracked task, not an assessor’s finding.

Live posture across all 12 PCI DSS requirements
Automatic alerts the moment a control drifts out of compliance
Remediation tasks auto-assigned with owners and deadlines
A defensible, time-stamped trail across the whole assessment period

Continuous monitoring12 requirements · checked hourly

Detected09:14 · CDE security group opened 0.0.0.0/0

AlertedOwner: Cloud team

Task openINFRA-2325 · due in 2 days

Verifiedauto re-check

Req 1.3.1 · Inbound traffic to the CDEDrifted 09:14 · remediation in progress

Drifting

Req 10.2 · Audit logsAll CDE components logging · last check 08:00

Passing

A defensible, time-stamped trail across the whole assessment periodAudit trail

Collect once, reuse everywhere

Your PCI DSS work becomes a head start on every other framework

PCI shares the majority of its controls with SOC 2, ISO 27001, HIPAA, and NIST. Compyl cross-maps each control so one piece of evidence satisfies every framework it touches.

One control mapped to its equivalent across 70+ frameworks
Collect evidence once and reuse it across every report
See instantly how PCI readiness translates to SOC 2 or ISO 27001
Add the next framework without starting the program over

One PCI DSS controlReq 8.4.2 · MFA for all access into the CDEMulti-factor authentication enforced for every user · evidence from Okta and AWS IAM1 piece of evidence

Also satisfies

SOC 2CC6.1 Logical access controls

Satisfied

ISO 27001A.8.5 Secure authentication · A.5.15 Access control

Satisfied

HIPAA Security Rule§164.312(d) Person or entity authentication

Satisfied

NIST CSF 2.0PR.AA-03 Users are authenticated

Satisfied

+ 70 more frameworks cross-mapped automatically

How you validate

SAQ or ROC, and quarterly scans

How you prove PCI compliance depends on your size and how you take payments. Compyl produces the evidence either path needs.

SAQ

Self-Assessment Questionnaire

Most merchants and service providers self-attest against the requirements that apply to their environment.

Who: Smaller merchants and eligible service providers
Cadence: Annual self-assessment
With Compyl: Pre-filled evidence for every applicable requirement

ROC Level 1

Report on Compliance & ASV scans

Larger volumes (typically Level 1) require an on-site assessment by a QSA, plus quarterly external scans by an ASV.

Who: Level 1 (~6M+ transactions a year)
Cadence: Annual ROC · quarterly scans
With Compyl: Continuous evidence the QSA can sample any day

Why Compyl for PCI DSS

Not a checkbox tool, a continuous compliance engine

Plenty of tools help you fill in a SAQ. Compyl keeps PCI true every day, tight scope, continuous evidence, and gaps caught before your QSA.

Continuous, not point-in-time

Evidence and controls stay live year-round, so your SAQ or ROC window is clean by default.

One connected system

Controls, evidence, risks, and policies in one platform, not a stack of disconnected tools.

125+ integrations

Pulls live data from the stack you already run, so posture reflects reality, not snapshots.

Agentic AI

AI maps controls, drafts remediations, and offloads busywork, your team stays in control.

Multi-framework by design

PCI evidence carries over to SOC 2, ISO 27001, HIPAA, and NIST without redoing the work.

Beyond PCI DSS

Secure cardholder data once, extend to every framework that follows

Compyl cross-maps controls so the work you do for PCI DSS carries straight into the next framework on your roadmap.

SOC 2 ISO 27001 ISO 42001 HIPAA GDPR NIST CSF NIST SP 800-53 MAS CCPA NIS2 70+ frameworks

Financial Services Higher Education User Access Reviews Evidence Studio

Recognized by users on G2 · Rated a leader by the teams who use it G2 Momentum Leader, Summer 2026

PCI requirements mapped to evidence and CDE scope

125+

Native integrations feeding evidence automatically

Real-time

Evidence collection, no manual screenshots

Year-round

Audit readiness instead of a pre-audit scramble

“It has brought a sense of relief to my life because, for the first time, we have a real solution in place that is proactively keeping us protected.”

JSJon SeniorCTO · via G2

What is PCI DSS, and how does Compyl help?

PCI DSS is the payment-card security standard from the PCI Security Standards Council, built on 12 requirements across six goals. It applies to any organization that stores, processes, or transmits cardholder data. The current version, v4.0.1, added many new requirements that became mandatory after March 2025. You validate annually through a Self-Assessment Questionnaire (SAQ) or a Report on Compliance (ROC) from a QSA, plus quarterly network scans. Compyl’s PCI compliance software automates evidence for all 12 requirements, continuously monitors your controls, helps you shrink and document your cardholder data environment, scores evidence health, and flags gaps, so your SAQ or ROC is a formality instead of an annual fire drill.

PCI DSS v4.0

What changed in PCI DSS v4.0, and how does software keep up?

PCI DSS v4.0 added 64 new requirements and a customized approach; its 51 future-dated requirements became mandatory on March 31, 2025, and v4.0.1 (June 2024) clarified the text without adding any. The 12 requirements sit under six goals; the table shows where the work moved.

Goal	Requirements	What v4.0 changed	With Compyl
Secure network and systems	1–2	Network security controls defined by intent, not just firewalls	Cloud and network integrations evidence configuration continuously
Protect account data	3–4	Stronger encryption and key management; cardholder data discovery	Data scope and encryption controls tracked as live evidence
Vulnerability management	5–6	Malware controls for removable media; expanded secure development	Vulnerability and code-repository data feed the controls
Access control	7–8	MFA for all access to the CDE; access reviews at least every six months	User access review campaigns mapped to Requirements 7 and 8
Monitor and test	10–11	Automated log review; authenticated internal scans	Logging integrations plus quarterly scan tracking
Policy	12	Targeted risk analyses; roles and responsibilities per requirement	Policy lifecycle with owners and review dates

FAQ

PCI DSS questions, answered

What is PCI DSS?

PCI DSS is the Payment Card Industry Data Security Standard, built on 12 requirements across six security goals. It applies to any organization that stores, processes, or transmits cardholder data. The current version is v4.0.1, and you validate annually through a SAQ or a QSA-issued ROC, plus quarterly network scans.

What changed in PCI DSS v4.0?

v4.0 added 64 new requirements, 51 of them future-dated, including targeted risk analyses, expanded multi-factor authentication, anti-phishing controls, and stronger requirements for service providers. Many were future-dated and became mandatory after March 2025, so programs that haven’t operationalized them now have gaps.

What is the difference between a SAQ and a ROC?

A Self-Assessment Questionnaire (SAQ) is a self-attestation used by smaller merchants and eligible service providers. A Report on Compliance (ROC) is an on-site assessment performed by a Qualified Security Assessor, typically required at Level 1 (around 6 million transactions a year). Both are supported by quarterly ASV scans.

How does Compyl automate PCI DSS?

Compyl connects to your stack, collects evidence for all 12 requirements, continuously monitors controls, helps shrink and document your cardholder data environment, scores evidence health, and flags gaps, so your SAQ or ROC is a formality instead of a fire drill.

How does Compyl score evidence quality?

Compyl 26.2 introduced Evidence Health, which continuously scores every piece of evidence on relevance, freshness, and completeness, with an AI summary of what’s missing, so gaps surface long before your assessment.

Can one PCI control satisfy other frameworks?

Yes. Compyl cross-maps each control so a single control and its evidence can satisfy PCI DSS alongside SOC 2, ISO 27001, HIPAA, and 70+ other frameworks. Collect once, reuse everywhere it applies.

Who is Compyl’s PCI DSS solution designed for?

Security and GRC teams at merchants, payment-handling SaaS companies, and service providers, CISOs, compliance managers, and IT leaders, who need to validate PCI annually and keep it true the rest of the year.

Is PCI DSS v4.0.1 still the current version in 2026?

Yes. PCI DSS v4.0 was retired on December 31, 2024, and v4.0.1 is the only active version. v4.0.1 was a limited revision with no new or deleted requirements, and the PCI Security Standards Council has not announced a successor.

Do SAQ A merchants still need to meet 6.4.3 and 11.6.1?

Not as SAQ A requirements. Since March 31, 2025, SAQ A no longer includes 6.4.3, 11.6.1 or 12.3.1. Instead, merchants must confirm their site is not susceptible to script attacks that could affect their e-commerce systems; if you can’t confirm that, SAQ A doesn’t fit.

Does using AI in payment systems change PCI scope?

The PCI SSC’s September 2026 information supplement on AI says AI should be treated like any other technology when scoping. If an AI component stores, processes or transmits account data, or can affect the security of the cardholder data environment, it is in scope. The supplement is guidance and adds no new requirements.

GRC your way

Make PCI DSS a formality, not an annual fire drill

See how Compyl’s PCI compliance software automates evidence for all 12 requirements, keeps your cardholder data scope tight, and flags gaps long before your QSA.

Request a demo See all frameworks →

Last reviewed September 2026 by the Compyl GRC team