{
  "code": "PCIDSS-4",
  "name": "PCI Data Security Standard v4.0",
  "version": "4.0",
  "issuing_body": "PCI Security Standards Council",
  "description": "Technical and operational requirements to protect payment data",
  "regions": ["global"],
  "industries": ["Financial Services", "Retail", "Technology"],
  "effective_date": "2022-03-31",
  "is_global": true,
  "requirements": [
    { "reference_code": "1", "title": "Install and Maintain Network Security Controls", "requirement_type": "mandatory", "category": "Network Security", "description": "Network security controls (NSCs) are network security controls are policies and procedures that define how an entity manages access to networks." },
    { "reference_code": "2", "title": "Apply Secure Configurations to All System Components", "requirement_type": "mandatory", "category": "Configuration Management", "description": "Malicious individuals often use vendor default passwords and other vendor default settings to compromise systems." },
    { "reference_code": "3", "title": "Protect Stored Account Data", "requirement_type": "mandatory", "category": "Data Protection", "description": "Protection methods such as encryption, truncation, masking, and hashing are critical components of account data protection.",
      "children": [
        { "reference_code": "3.1", "title": "Processes and mechanisms for protecting stored account data are defined and understood", "requirement_type": "mandatory" },
        { "reference_code": "3.2", "title": "Storage of account data is kept to a minimum", "requirement_type": "mandatory" },
        { "reference_code": "3.3", "title": "Sensitive authentication data (SAD) is not retained after authorization", "requirement_type": "mandatory" },
        { "reference_code": "3.4", "title": "Access to displays of full PAN and ability to copy PAN are restricted", "requirement_type": "mandatory" },
        { "reference_code": "3.5", "title": "Primary account number (PAN) is secured wherever it is stored", "requirement_type": "mandatory" }
      ]
    },
    { "reference_code": "4", "title": "Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks", "requirement_type": "mandatory", "category": "Encryption in Transit",
      "children": [
        { "reference_code": "4.2.1", "title": "Strong cryptography used for all cardholder data transmissions", "description": "Use strong cryptography and security protocols to safeguard PAN during transmission over open, public networks.", "requirement_type": "mandatory" }
      ]
    },
    { "reference_code": "5", "title": "Protect All Systems and Networks from Malicious Software", "requirement_type": "mandatory", "category": "Malware Protection" },
    { "reference_code": "6", "title": "Develop and Maintain Secure Systems and Software", "requirement_type": "mandatory", "category": "Secure Development",
      "children": [
        { "reference_code": "6.2", "title": "Bespoke and custom software are developed securely", "requirement_type": "mandatory" },
        { "reference_code": "6.3", "title": "Security vulnerabilities are identified and addressed", "requirement_type": "mandatory" },
        { "reference_code": "6.4", "title": "Public-facing web applications are protected against attacks", "requirement_type": "mandatory" }
      ]
    },
    { "reference_code": "7", "title": "Restrict Access to System Components and Cardholder Data by Business Need to Know", "requirement_type": "mandatory", "category": "Access Control" },
    { "reference_code": "8", "title": "Identify Users and Authenticate Access to System Components", "requirement_type": "mandatory", "category": "Identity & Authentication",
      "children": [
        { "reference_code": "8.2", "title": "User identification and related accounts for users and administrators are strictly managed", "requirement_type": "mandatory" },
        { "reference_code": "8.3", "title": "User authentication for users and administrators is established and managed", "requirement_type": "mandatory" },
        { "reference_code": "8.4", "title": "Multi-factor authentication (MFA) is implemented to secure access", "requirement_type": "mandatory" }
      ]
    },
    { "reference_code": "9", "title": "Restrict Physical Access to Cardholder Data", "requirement_type": "mandatory", "category": "Physical Security" },
    { "reference_code": "10", "title": "Log and Monitor All Access to System Components and Cardholder Data", "requirement_type": "mandatory", "category": "Logging & Monitoring",
      "children": [
        { "reference_code": "10.2", "title": "Audit logs capture all individual user access to cardholder data", "requirement_type": "mandatory" },
        { "reference_code": "10.3", "title": "Audit logs are protected from destruction and unauthorized modifications", "requirement_type": "mandatory" },
        { "reference_code": "10.5", "title": "Retain audit log history for at least 12 months", "requirement_type": "mandatory" }
      ]
    },
    { "reference_code": "11", "title": "Test Security of Systems and Networks Regularly", "requirement_type": "mandatory", "category": "Security Testing",
      "children": [
        { "reference_code": "11.3", "title": "External and internal penetration testing is regularly performed", "requirement_type": "mandatory" },
        { "reference_code": "11.5", "title": "Network intrusions and unexpected file changes are detected and responded to", "requirement_type": "mandatory" }
      ]
    },
    { "reference_code": "12", "title": "Support Information Security with Organizational Policies and Programs", "requirement_type": "mandatory", "category": "Governance",
      "children": [
        { "reference_code": "12.1", "title": "Comprehensive information security policy is known and current", "requirement_type": "mandatory" },
        { "reference_code": "12.3", "title": "Risks to the cardholder data environment are formally identified, evaluated, and managed", "requirement_type": "mandatory" },
        { "reference_code": "12.10", "title": "Suspected and confirmed security incidents that could impact the CDE are responded to immediately", "requirement_type": "mandatory" }
      ]
    }
  ]
}