PCI DSS Book Series on PCI Resources

Summary of changes in the 4.0 edition of the book

Mon, 01 Jan 0001 00:00:00 +0000

Summary of changes in the 4.0 edition of the book

The original 3 volumes were written between fall 2014 and summer 2015 for PCI DSS 3.1; the fourth in 2017 for 3.2. They were only slightly modified based on changes from PCI DSS 3.1 to 3.2 and 3.2.1.

This version includes many more changes including:

Terminology (see 1.8.7.1)
Requirement changes both language and numbering
- All numbers are from 4.0, but the equivalent 3.2.1 number is present if available, e.g:
  - 12.5.1, v3#2.4
Images

Summary of changes in the 4.0.1 edition of the book

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Summary of changes in the 4.0.1 edition of the book

The original 3 volumes were written between fall 2014 and summer 2015 for PCI DSS 3.1; the fourth in 2017 for 3.2. They were only slightly modified based on changes from PCI DSS 3.1 to 3.2 and 3.2.1. The fifth release for 4.0 in 2022 was as major a change as version 4.0 was to 3.2.1, the summary of changes in the 4.0 edition is still available.

Table of Content - Volume 1 (PCI DSS 4.0.1 edition)

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Volume 1 - A Business Case for the PCI DSS (PCI DSS 4.0.1 edition)

1.1 Volume Introduction
1.2 Why PCI DSS?
- 1.2.1 The value of card information
- 1.2.2 The costs of PCI DSS
1.3 How We Got Here - An Oversimplified History of the Payment Card Industry (PCI)
- 1.3.1 From metals to paper
- 1.3.2 Development of the financial industry in the USA
- 1.3.3 The credit card era
- 1.3.4 Credit card and the internet - or the automated fraud era
- 1.3.5 Government Reaction to Accounting Scandals and Industry Reaction
1.4 Who should care about the PCI DSS?
- 1.4.1 The payment card model
- 1.4.2 Anatomy of payment card transactions
- 1.4.3 Clearing and Settlement
1.5 So what exactly is PCI DSS?
- 1.5.1 PCI DSS and the PCI SSC
- 1.5.2 Defining the PCI DSS?
- 1.5.3 PCI DSS at a high-level
- 1.5.4 High-level overview of other PCI standards
  - 1.5.4.1 Issuer Standards
  - 1.5.4.2 Software Security Standards
  - 1.5.4.3 Device Security Standards
  - 1.5.4.4 Payment Device and COTS (Commercial off the Shelf) Devices (aka mobile phones)
1.6 How should PCI DSS compliance be addressed?
- 1.6.1 From physical security to basic network security: Fort Knox or the ‘castle’ metaphor
- 1.6.2 Network complexity and virtualization lead to cloud computing
- 1.6.3 New approaches
1.7 Demonstrating PCI DSS compliance
- 1.7.1 RoC vs SAQ (and AoC)
- 1.7.2 Merchant Compliance
- 1.7.3 Service Provider Compliance
- 1.7.4 Other compliance - issuers, acquirers
1.8 Where do we go from here? The evolution of the PCI DSS standard
- 1.8.1 Early PCI DSS versions: versions 1.0, 1.1, 1.2 and 1.2.1
- 1.8.2 PCI DSS 2.0
- 1.8.3 PCI DSS 3.0 and 3.1
- 1.8.4 PCI DSS Designated Entities Supplemental Validation (DESV)
- 1.8.5 PCI DSS 3.2
- 1.8.6 PCI DSS 3.2.1
- 1.8.7 PCI DSS 4.0 and 4.0.1
  - 1.8.7.1 PCI DSS 4.0 - New terminology (Glossary)
  - 1.8.7.2 PCI DSS 4.0 Structural changes
  - 1.8.7.3 PCI DSS 4.0 Major Requirement Changes
  - 1.8.7.4 PCI DSS 4.0.1
1.9 The rise of genAI (summer 2026 status)
1.10 Parting thoughts for PCI DSS 4.0.1 version (Summer 2026)
End Notes - Volume 1

Table of Content - Volume 2 (PCI DSS 4.0.1 edition)

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Volume 2 - PCI DSS Scoping (PCI DSS 4.0.1 edition)

2.1 Volume Terminology and Acronyms
2.2 PCI Resources basic diagrams
- 2.2.1 PCI Resources Base Network Diagram
2.3 Scoping
- 2.3.1 It all starts with data
2.4 PCI DSS Scoping explained
2.5 PCI Resources Simplified PCI DSS Scoping Model and Approach
- 2.5.1 Categories Summary
2.6 Simplified Approach and Scoping categories
- 2.6.1 Simplified Approach Part 1 - CDE (steps 1-3)
- 2.6.2 Simplified Approach Part 2 - Connected systems (steps 4-6)
- 2.6.3 Out-of-scope systems
- 2.6.4 Scope Documentation
- 2.6.5 Comparison to other models
2.7 Scope Reduction Methods
- 2.7.1 Outsourcing
- 2.7.2 Data Reduction (via PAN Transformations)
- 2.7.3 Segmentation / Isolation
2.8 Advanced Scoping
- 2.8.1 eCommerce
- 2.8.2 Card Present payments using Mobile payment devices as terminals
- 2.8.3 Virtualization and Cloud
- 2.8.4 Complex Virtualization Cases
- 2.8.5 Scope of Emails and Instant Messaging Solutions
- 2.8.6 Scope using genAI/LLM (summer 2026 status)
- 2.8.7 Non-covered technologies
2.9 Sources and References
End Notes - Volume 2
Appendix 2A - PCI DSS Scope Documentation Guidance for PCI DSS 4.0 .1

Table of Content - Volume 3 (PCI DSS 4.0.1 edition)

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Volume 3 - Building a PCI DSS Information Security Program (PCI DSS 4.0.1 edition)

Volume 3 - Building a PCI DSS Information Security Program

3.1 Volume Introduction
3.2 The High-Level PCI DSS requirements
3.3 Building a PCI DSS Information Security Program
- 3.3.1 Where you come from matters
- 3.3.2 Information Security Programs are meant to address Risks
- 3.3.3 Information Security Frameworks
3.4 Considerations for an Information Security Program
- 3.4.1 Recapping the PCI DSS data elements
- 3.4.2 Data Classification
- 3.4.3 Examples of data classification
- 3.4.4 Governance
3.5 The PCI DSS Information Security Program Structure (the head of the program)
- 3.5.1 (Information Security) Policies (Sections 12.1, 12.2, X.1)
- 3.5.2 Responsibilities for the program (Section 12.1)
- 3.5.3 Targeted Risk Assessments (TRA, Section 12.3)
- 3.5.4 PCI DSS Program and Monitoring (Service Provider, Section 12.4)
- 3.5.5 Scope : Documenting usage of card information (Section 12.5)
- 3.5.6 Security awareness (Section 12.6)
- 3.5.7 Human Resource Security (Section 12.7)
- 3.5.8 Managing Third-party service providers (TPSP) (Section 12.8)
- 3.5.10 Incident Response Management (Section 12.10)
3.6 The body of the program
- 3.6.1 Objective 1: Build and Maintain a Secure Network and Systems
- 3.6.2 Objective 2: Protect Account Data
- 3.6.3 Objective 3: Maintain a Vulnerability Management Program
- 3.6.4 Objective 4: Implement Strong Access Control Measures
- 3.6.5 Objective 5: Regularly Monitor and Test Networks
3.7 Additional Requirements
- 3.7.1 Requirement Appendix A1:Multi-tenant service provider (previously called shared service provider) requirements
- 3.7.2 Requirement Appendix A2: Secure transmission of CHD from payment devices (cryptography for data in motion)
- 3.7.3 Requirement Appendix A3: Designated Entities Supplemental Validation (DESV)
3.8 Controls to consider when using, and to protect from, genAI/LLM
- 3.8.1 Controls when using genAI
- 3.8.2 Use of genAI to supplement controls
- 3.8.3 Impact of genAI and similar tools on the threat landscape
3.9 Addressing compliance gaps - prioritization
3.10 When you cannot meet the “defined approach” as is
- 3.10.1 Compensating Controls - the old way
- 3.10.2 Customized Approach - the new way
3.11 Total Cost of Ownership (TCO) and Return-on-Investment (ROI)
End Notes - Volume 3
Appendix 3A - Network Primer
Appendix 3B - A primer on encryption

Table of Content - Volume 4 (PCI DSS 4.0.1 edition)

Mon, 01 Jan 0001 00:00:00 +0000

Back to books home

Volume 4 - Hypothetical Case Studies - From Jane’s Flower Attic to Jane’s Flower Emporium (PCI DSS 4.0.1 edition)

Volume 4 - Hypothetical Case Studies
4.1 Volume Introduction
- 4.1.1 Assumptions
4.2 Jane’s journey - Step 1 - A small side business
- 4.2.1 Jane’s Flower Attic (JFA) business
- 4.2.2 Applying SAQ-B-IP using a cellular network connection to the payment device
4.3 - Step 2 - Jane’s Flower Boutique (JFB)
- 4.3.1 JFB Network Security Control (NSC, e.g. firewall) standard
4.4 Step 3 - Jane’s Flower Chain (JFC)
- 4.4.1 Network level controls
- 4.4.2 Identification and Authentication controls
- 4.4.3 Physical security controls
- 4.4.4 System level controls
- 4.4.5 Application level controls
- 4.4.6 Logging and Monitoring
- 4.4.7 Testing
- 4.4.8 Governance, Policies, Procedures
- 4.4.9 Incident Response
4.5 - Step 4 - Jane’s Flower Depot (JFD)
4.6 - Step 4 - Jane’s Flower Emporium (JFE)
- 4.6.1 JFE Organizational Structure
- 4.6.2 Best-practice in information security governance - Information security separate from IT
- 4.6.3 Payment transactions
- 4.6.4 Card present payments in stores and at delivery
- 4.6.5 Customer Service and MOTO transactions
- 4.6.6 eCommerce
- 4.6.7 The Information Security Program (based on ISO 27002)
End Notes - Volume 4
Appendix 4A - JFA Information Security Policy (simplified example)
Appendix 4B - JFB NSC (firewall) standard
Appendix 4C - JFC Incident Response Plan
Appendix 4D - JFD Payment Device Tampering Review Process
Appendix 4E - JFE Information Security Policy
Appendix 4F - JFE Risk Assessment