PCI DSS v4.0.1 control library
Every control CMDash tracks for PCI DSS v4.0.1, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.
63 controls12 families18 mapped to other frameworksIdentifiers and titles only — text is licensed
Why the control text is not on this page
The PCI SSC publishes the standard at no cost under a click-through licence that does not permit redistribution, so the requirement text cannot be embedded here.
CMDash publishes the identifiers, titles and cross-framework mappings so you can see the shape of what is tracked, and links you to PCI Security Standards Council for the document itself. A tenant that holds its own licence can load the real text through the framework import.
Download free from the PCI SSC Document Library →Families
Network Security Controls · 5
| 1.1 | Processes and mechanisms defined and understood |
| 1.2 | Network security controls configured and maintained Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 1.3 | Network access to and from CDE restricted |
| 1.4 | Network connections between trusted and untrusted controlled |
| 1.5 | Risks to CDE from computing devices mitigated |
Secure Configurations · 3
| 2.1 | Processes and mechanisms defined and understood |
| 2.2 | System components configured and managed securely Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 2.3 | Wireless environments secured |
Stored Data Protection · 7
| 3.1 | Processes and mechanisms defined and understood |
| 3.2 | Storage of account data minimized |
| 3.3 | Sensitive authentication data not stored after authorization |
| 3.4 | PAN secured wherever stored Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 3.5 | PAN secured wherever transmitted |
| 3.6 | Cryptographic keys managed securely |
| 3.7 | Stored SAD encrypted with strong cryptography |
Transmission Encryption · 2
| 4.1 | Processes and mechanisms defined and understood |
| 4.2 | PAN protected with strong cryptography during transmission Maps to NIST Cybersecurity Framework (1.1, legacy) |
Malware Protection · 4
| 5.1 | Processes and mechanisms defined and understood |
| 5.2 | Malware prevented, detected, and addressed Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 5.3 | Anti-malware mechanisms active and maintained |
| 5.4 | Anti-phishing mechanisms protect against phishing |
Secure Development · 5
| 6.1 | Processes and mechanisms defined and understood |
| 6.2 | Bespoke and custom software developed securely Maps to NIST Cybersecurity Framework (1.1, legacy) |
| 6.3 | Security vulnerabilities identified and addressed Maps to NIST Cybersecurity Framework (1.1, legacy) |
| 6.4 | Public-facing web applications protected |
| 6.5 | Changes to all system components managed securely Maps to ISO/IEC 27001:2022 |
Access Restriction · 3
| 7.1 | Processes and mechanisms defined and understood |
| 7.2 | Access to system components and data appropriately defined Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 7.3 | Access to system components and data managed via access control systems |
User Identification · 6
| 8.1 | Processes and mechanisms defined and understood |
| 8.2 | User identification and related accounts managed |
| 8.3 | Strong authentication established Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 8.4 | MFA implemented for CDE access |
| 8.5 | MFA systems configured and managed |
| 8.6 | Application and system account management |
Physical Access · 5
| 9.1 | Processes and mechanisms defined and understood |
| 9.2 | Physical access controls manage entry Maps to NIST Cybersecurity Framework (1.1, legacy) |
| 9.3 | Physical access to sensitive areas controlled |
| 9.4 | Media with cardholder data secured |
| 9.5 | POI devices protected from tampering |
Logging & Monitoring · 7
| 10.1 | Processes and mechanisms defined and understood |
| 10.2 | Audit logs record anomalies and suspicious activity Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
| 10.3 | Audit logs protected from destruction |
| 10.4 | Audit logs reviewed for anomalies Maps to NIST Cybersecurity Framework (1.1, legacy) |
| 10.5 | Audit log history retained and available |
| 10.6 | Time-synchronization technology in use |
| 10.7 | Failures of critical security controls detected and addressed |
Security Testing · 6
| 11.1 | Processes and mechanisms defined and understood |
| 11.2 | Wireless access points identified and monitored |
| 11.3 | External and internal vulnerabilities regularly identified Maps to NIST Cybersecurity Framework (1.1, legacy) |
| 11.4 | Penetration testing performed regularly Maps to NIST Cybersecurity Framework (1.1, legacy) |
| 11.5 | Network intrusions and file changes detected and responded to |
| 11.6 | Unauthorized changes to payment pages detected |
Organizational Policies · 10
| 12.1 | Information security policy established and maintained Maps to NIST Cybersecurity Framework (1.1, legacy) |
| 12.2 | Acceptable use policies defined |
| 12.3 | Risks to CDE formally identified and managed |
| 12.4 | PCI DSS compliance managed |
| 12.5 | PCI DSS scope documented and validated |
| 12.6 | Security awareness education ongoing Maps to NIST Cybersecurity Framework (1.1, legacy) |
| 12.7 | Personnel screened to reduce insider threats |
| 12.8 | Third-party service provider risk managed |
| 12.9 | TPSPs support PCI DSS compliance |
| 12.10 | Security incidents and vulnerabilities responded to promptly Maps to ISO/IEC 27001:2022, NIST Cybersecurity Framework (1.1, legacy) |
Where this comes from
Control identifiers, families and titles are the rows CMDash’s own seed data writes for PCI DSS v4.0.1 4.0.1, published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.
Track these controls in CMDash
Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.