Run PCI DSS 4.0.1 from one record.
PCI DSS applies to anyone who stores, processes or transmits payment card data. In Alvor each requirement gets an owner, an applicability decision and evidence, scheduled checks test your cloud and identity settings, and findings become tasks or risks.
PCI DSS overview
The standard behind every card transaction
12
Requirement families
6
Goals
March 2025
Future-dated requirements took effect
PCI DSS is required for any organization that stores, processes, or transmits payment card data. Version 4.0 introduced a customized approach alongside the traditional defined approach, giving organizations flexibility in how they meet security objectives. Its twelve principal requirements sit under six goals, and the work runs all year: quarterly scans, ongoing monitoring and change control.
Domain coverage
Six goals, twelve requirements
PCI DSS 4.0 organizes its requirements into six goals and twelve families covering the full scope of cardholder data protection.
Network Security
Install and maintain network security controls and apply secure configurations to all system components. Covers firewalls, segmentation, and hardening standards.
Account Data Protection
Protect stored account data and protect cardholder data with strong cryptography during transmission over open networks.
Vulnerability Management
Protect systems against malicious software and develop and maintain secure systems and software. Covers patching, anti-malware, and secure SDLC.
Access Control
Restrict access by business need-to-know, identify users and authenticate access, and restrict physical access to cardholder data.
Monitoring & Testing
Log and monitor all access to system components and cardholder data. Test security of systems and networks regularly.
Security Policies
Support information security with organizational policies and programs. Covers security awareness, incident response, and risk assessments.
Common challenges
PCI DSS non-compliance means losing the ability to process payments
The problem
Quarterly vulnerability scans and annual penetration tests generate findings that sit in PDF reports nobody tracks
How Alvor helps
Vulnerability findings from Rapid7 InsightVM, GitHub Dependabot, GitLab and Veracode attach to the asset they belong to. A compliance finding can be escalated into the risk register with a named owner.
The problem
Cardholder data environment scope keeps expanding because nobody maintains a current data flow diagram
How Alvor helps
Draw the cardholder data environment, its data flows and trust boundaries on the Secure by Design canvas, with each diagram version approved by an architect.
The problem
Assessment prep takes weeks of cross-department coordination to gather evidence from a dozen different systems
How Alvor helps
Evidence is uploaded once and linked to every requirement it supports, with a valid-until date and a reminder to the person who uploaded it before it expires. Inside an audit, request evidence from control owners with a due date and track each request until it is assessed.
The problem
Compensating controls are documented in Word files with no connection to the requirements they address
How Alvor helps
Record the risk behind a compensating control in Risk Management and link it from the requirement's control, where the link shows on both records.
What you get
PCI DSS requirements in one record
PCI DSS 4.0.1 in the framework library
PCI DSS 4.0.1 installs under your license with its twelve requirements, and the sub-requirements load from your licensed copy of the standard. Each one works like any other control: an owner, an applicability decision, evidence with an expiry date, and a status set by an assessment, a check or a recorded override.
CDE scope management
Document the cardholder data environment, its data flows and segmentation on the Secure by Design canvas. Each diagram is versioned, and every change after baseline is classified minor or major with the reason kept.
Vulnerability findings on the asset
Rapid7 InsightVM, GitHub Dependabot, GitLab and Veracode findings attach to the asset they belong to, and InsightVM closes a finding when it no longer appears. Upload ASV scan and penetration test reports as evidence on the requirements they support.
Evidence linked once
Upload evidence once and link it to every requirement it supports. Each file carries a valid-until date, and the person who uploaded it is told 30 days before it expires.
Customized approach documentation
Record each targeted risk analysis as a risk with likelihood, impact, a named owner and a review date, link it from the requirement's control, and keep custom controls in a framework you build yourself.
Scheduled control checks
Checks bound to a control run hourly, every four hours, daily or weekly. A failing resource writes a finding and moves the control's status, and accepted exceptions are recorded with an expiry.
Frequently asked
Common questions about PCI DSS
What teams need to know about merchant levels, scope reduction, and maintaining PCI DSS compliance between annual assessments.
PCI DSS applies to any organization that stores, processes, or transmits cardholder data: merchants, service providers, payment processors, and the systems connected to them. The specific validation requirements depend on your merchant level, which is determined by annual card transaction volume and the card brands you work with.
Get started
See how Alvor works for your role
Whether you lead security, run IT, manage compliance, or sit in the C-suite - we'll show you your view.