Control mapping available
PCI DSS
PCI DSS v4.0.1
PCI DSS defines 12 requirements for protecting cardholder data. Version 4.0 added stronger rules for system and application accounts (non-human identities), targeted risk analyses, and automated log review; the future-dated requirements became mandatory on 31 March 2025.
Applies to: Any organization that stores, processes, or transmits payment card data.
What to Know
- Requirement 8.6 covers system and application accounts: no hard-coded passwords, periodic rotation, and controlled interactive use.
- Requirement 10.4.1.1 expects automated mechanisms for audit log review.
- Requirement 6.3 covers identifying and ranking vulnerabilities, including in third-party components.
Controls Lionhouse Helps With
The engineering-owned controls where continuous evidence saves the most time. Policies, training, and physical controls are tracked in trustlynce too.
| Reference | Control | How Lionhouse helps | Products |
|---|---|---|---|
| Req. 8.6 | System and application accounts | TrustIvan inventories service accounts and tokens, detects hard-coded secrets in code and CI, and automates rotation. | TrustIvan |
| Req. 6.3 | Security vulnerabilities are identified and addressed | TrustIvan scans containers and SBOMs, including third-party components, and ranks findings. | TrustIvan |
| Req. 10.2 / 10.4 | Audit logs and automated review | aiAxonIQ stores audit logs with retention policies and flags anomalies automatically. | aiAxonIQ |
| Req. 12.8 | Third-party service providers | trustlynce tracks service provider responsibilities and evidence of their compliance. | trustlynce |
Lionhouse helps you prepare and maintain evidence. Your auditor or certification body makes the final determination.
Other Frameworks
Talk to an Architect
See the Four Products Running in Your Environment.
A technical session with a Lionhouse architect covering your stack, your deployment model, and a pilot plan.