01
Network Security (Req 1-2)
Network security controls, no vendor-supplied defaults, and a segmented CDE with every connection documented.
PCI DSS Compliance Automation, Built for v4.0.1
pTrackly automates the recurring work of PCI DSS v4.0.1: evidence tasks with reminders, access reviews and daily cloud checks, plus a shared workspace for your QSA. The assessment, the ROC or SAQ and the AOC stay with you and your assessor.
Payment Security v4.0
Req 1-2Network Security
Req 3-4Data Protection
Req 5-6Vulnerability Mgmt
Req 7-12Access & Monitoring
Why PCI DSS Matters
-
Acquirers ask for validation
Card brands and acquiring banks require merchants and service providers to validate PCI DSS compliance. Consequences of non-compliance are set by the brands and your acquirer, not by PCI SSC.
-
v4.0.1 is the only active version
PCI DSS v4.0 was retired on 31 December 2024, and every future-dated v4.x requirement became mandatory on 31 March 2025.
-
CDE scope is easy to underestimate
A scoping error found during a QSA assessment can send the engagement back to the start.
12 requirements PCI DSS v4.0.1
How PCI DSS Compliance Automation Works in pTrackly
Step 01
Connect and scope
Connect cloud accounts and identity systems, onboard your team, and record what is in your CDE.
Step 02
Close the gaps
Policy templates and evidence tasks mapped to PCI DSS v4.0.1 controls, with owners and due dates.
Step 03
Assessment
Share evidence with your QSA in the Auditor portal, or prepare your SAQ, and close findings.
Step 04
ROC or SAQ and AOC
Your QSA or your team completes the assessment and the AOC goes to your acquirer. Recurring tasks keep running.
PCI DSS v4.0.1 Requirements Coverage
02
Protect Account Data (Req 3-4)
Protect stored cardholder data with truncation, tokenization, or encryption, and data in transit with strong cryptography.
03
Access Control (Req 7-8)
Least privilege and unique IDs. v4.x requires MFA for all non-console access into the CDE and for all remote access.
04
Monitoring & Testing (Req 10-11)
Audit logs kept 12 months with 3 months immediately available, quarterly ASV scans, and penetration tests at least every 12 months.
05
Security Policy (Req 12)
Policies reviewed at least every 12 months, targeted risk analyses, security awareness training, and an incident response plan tested every year.
What pTrackly Automates for PCI DSS
Recurring evidence on a schedule
Each evidence task has a frequency and a review date. Owners get reminders 7, 3 and 1 days before it is due, and tasks overdue by 7 or 21 days escalate.
Daily cloud checks behind your evidence
Checks on AWS, Google Cloud, Azure and Cloudflare can run daily on an evidence task. When a review comes due and a check is failing, the task moves to Failed.
Access reviews that finish on time
Recurring reviews of people, Google Workspace apps and recorded app accounts, with manager reviewers and escalation when a review runs late.
A QSA workspace with a frozen evidence set
Your QSA works the request list in the Auditor portal. Locking the audit freezes the evidence and records a SHA-256 fingerprint for each file.
What can PCI DSS compliance automation do?
PCI DSS compliance automation handles the recurring, provable work: scheduling evidence, reminding owners, running cloud checks, tracking access reviews and keeping assessor-ready records. It does not validate compliance. A Qualified Security Assessor (QSA) completes a Report on Compliance, or your team completes a Self-Assessment Questionnaire, and quarterly external scans must come from a PCI SSC-listed Approved Scanning Vendor (ASV).
What pTrackly automates
- Evidence tasks with a frequency (daily to yearly), reminders 7, 3 and 1 days before due, and escalation at 7 and 21 days overdue
- Daily cloud checks on AWS, Google Cloud, Azure and Cloudflare attached to evidence tasks
- Recurring access reviews of people, Google Workspace apps and recorded app accounts
- Policy review cycles with approval and employee acceptance
- Service provider records with the PCI DSS AOC and warnings 60 and 30 days before it expires
- Pentest findings, remediation status and reports
- An Auditor portal for your QSA and a locked, fingerprinted evidence set
What stays with you, your assessor and your tools
- Scoping decisions and segmentation testing
- The assessment itself: the ROC by a QSA, or the SAQ by your team, and signing the AOC
- Quarterly external vulnerability scans by an ASV (Requirement 11.3.2)
- Log monitoring (SIEM), file integrity monitoring, PAN discovery and payment-page script monitoring
- Fixing the controls in your own systems
Recurring PCI DSS v4.0.1 requirements and what pTrackly helps with
These requirements repeat on a fixed cadence, which is where most of the ongoing effort goes. Requirement numbers follow PCI DSS v4.0.1.
| Requirement | What it asks for | How pTrackly helps |
|---|---|---|
| 1.2.7 | Review network security control configurations at least every 6 months | Evidence task with an owner, review date and reminders |
| 7.2.4 | Review user accounts and access privileges at least every 6 months | Access review repeating every 6 months, with escalation |
| 8.4.2 | MFA for all non-console access into the CDE | AWS IAM checks (MFA, root, access keys); evidence tasks for other systems |
| 10.4.1 | Review audit logs at least daily | Done in your SIEM; pTrackly holds the evidence that the review happens |
| 11.3.2 | External vulnerability scans by an ASV at least every three months | Quarterly evidence task for the ASV scan reports |
| 11.4.1–11.4.3 | Penetration testing at least every 12 months and after significant changes | Pentest module for findings, remediation and the final report |
| 12.1.2 | Review the information security policy at least every 12 months | Policy review frequency, approval and employee acceptance |
| 12.8.4 | Monitor service providers' PCI DSS compliance status at least every 12 months | Vendor records with the PCI DSS AOC and expiry warnings |
| 12.10.2 | Review and test the incident response plan at least every 12 months | Yearly evidence task with reminders |
Sources: PCI SSC Document Library · PCI SSC: PCI DSS v4.0.1 published · PCI SSC: future-dated requirements of PCI DSS v4.x
Frequently asked questions
Can PCI DSS compliance be fully automated?
No. A platform can schedule and collect evidence, run some technical checks and remind owners, but scoping, the assessment, ASV scans and many technical controls need people and specialised tools. A QSA, or your own team on an SAQ, validates compliance.
Does pTrackly replace a QSA or an ASV?
No. pTrackly is not a QSA or an ASV. It prepares evidence and gives your QSA a workspace; the ROC or SAQ and the AOC are completed by the assessor or your team, and external scans come from a PCI SSC-listed ASV.
Which PCI DSS version does pTrackly use?
PCI DSS v4.0.1, the only active version. PCI SSC retired v4.0 on 31 December 2024, and all future-dated v4.x requirements became mandatory on 31 March 2025.
How long does PCI DSS compliance take?
It depends on your scope, your merchant or service provider level and what is already in place. Merchant levels are set by the card brands, so confirm yours with your acquirer before you plan the assessment.