# PCI DSS v4.0 Coverage Matrix

Sources: PCI DSS v4.0 Requirements and Testing Procedures and PCI DSS v4.0 SAQ D for Merchants.

| Axis | Covered when | Implicit when | Gap when |
| --- | --- | --- | --- |
| `Install and Maintain Network Security Controls` | Network security controls, CDE boundaries, connections, allowed services, and configuration expectations are stated. | The design has no CDE, no network path affecting account data, and states why PCI DSS is out of scope. | Cardholder data or CDE connectivity exists without network security controls. |
| `Protect Stored Account Data` | Stored account data, PAN rendering, storage minimization, sensitive authentication data handling, and key management are specified. | The design documents that account data is never stored electronically. | Account data can be stored but protection, retention, PAN, SAD, or key handling is absent. |
| `Maintain a Vulnerability Management Program` | Malware protection, vulnerability identification, patching/remediation, and recurring reviews are specified. | The environment has no systems or networks that store, process, transmit, or affect cardholder data. | CDE systems exist without malware or vulnerability-management coverage. |
| `Restrict Access to System Components and Cardholder Data by Business Need to Know` | Access roles, least privilege, business-need grants, review, and modification workflows are specified. | No users or services can access cardholder data or CDE system components. | Access to cardholder data or CDE components is possible without least privilege or business-need rules. |
| `Regularly Monitor and Test Networks` | Logging, monitoring, vulnerability scanning, penetration testing, and control-failure response are specified. | No network, system, or cardholder data environment is in PCI DSS scope. | CDE controls exist without audit logs, monitoring, scans, or testing. |
| `Support Information Security with Organizational Policies and Programs` | Information security policy, acceptable use, risk analysis, third-party management, and responsibility ownership are specified. | A documented third party owns the full PCI DSS program and the local environment cannot affect CDE security. | PCI DSS responsibilities or third-party payment functions exist without policy/program coverage. |
| `Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks` | Strong cryptography, trusted keys/certificates, and transmission paths over open public networks are specified. | Cardholder data is never transmitted over open, public networks. | Cardholder data is sent over open, public networks without cryptographic requirements. |
| `Develop and Maintain Secure Systems and Software` | Secure development, vulnerability remediation, change management, and payment page script controls are specified. | No software or system component affects account data or the CDE. | Applications or system changes affect cardholder data without secure software controls. |
| `Personnel screening` | Pre-hire screening or a documented legal/regional exception is specified for relevant sensitive roles. | No personnel role can affect the CDE or cardholder data, or local law prohibits screening and alternatives are stated. | Sensitive payment roles exist without screening or compensating governance. |
| `Restrict Physical Access to Cardholder Data` | Physical access controls, visitor/media handling, POI device controls, and disposal expectations are specified. | Cardholder data and payment devices are fully hosted by a documented third party with no local physical access. | Cardholder data, media, devices, or CDE systems exist without physical access controls. |
| `Security incident response plan` | Incident response plan, roles, suspected/confirmed incident handling, training, testing, and lessons learned are specified. | The design explicitly has no PCI DSS scope and incident handling is owned by another assessed entity. | Account data or CDE controls exist without incident response plan coverage. |
| `PCI DSS scope` | Scope includes people, processes, technologies, system components, locations, third parties, and cardholder data flows. | The design states that no account data is stored, processed, transmitted, or can be impacted. | Payment functionality exists but CDE scope, data flows, or included systems are unclear. |

Reviewers should classify each axis as `covered`, `implicit`, or `gap`.
Findings are emitted only for `gap`.
