BY NEURABYTE
FRAMEWORKS/SECURITY/PCI DSS 4.0
PCI
SECURITY · PCI Security Standards Council

PCI DSS 4.0

Required wherever cardholder data is stored, processed, or transmitted.

PCI DSS is a contractual standard enforced by the card brands through acquiring banks. Version 4.0 became mandatory in March 2024, with future-dated requirements effective March 2025. Validation is by self-assessment questionnaire or a Qualified Security Assessor, depending on transaction volume.

AT A GLANCE
ISSUERPCI Security Standards Council REGIONInternational CATEGORYSecurity CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Any organization whose systems or agents touch payment card data
02Platforms whose agents operate refund, billing, or checkout workflows
03Service providers to merchants
02. KEY REQUIREMENTS

The parts of PCI DSS 4.0 that touch what agents do.

Req. 7 Restrict access
Access to system components and cardholder data is limited to need-to-know.
Req. 8 Identify users
Every action is attributable to an identified individual or system account.
Req. 10 Log and monitor
All access to cardholder data and all privileged actions are logged, protected from alteration, and reviewed.
Req. 6 Secure systems
Changes to production are authorized and tracked through change control.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against PCI DSS 4.0. Where there is no evidence, the report says gap.

LORE CONTROL PCI DSS 4.0 REFERENCE
Blocking authorization gate7.2, 8.2
Maker–checker approval6.5.1
Signed, hash-chained receipts10.2, 10.3
Context disclosure record3.3, 10.2.1
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Network segmentation, encryption at rest for the CDE, and vulnerability scanning are infrastructure controls.
Scoping the cardholder data environment is yours and your QSA's.
05. QUESTIONS
Can agents touch card data under PCI?
Only with the same controls a human operator would need: least privilege, attribution, and tamper-evident logs. That is what the gate and receipts provide.
SAQ or ROC?
Depends on your merchant level and processing model. Ask your acquirer.
Does Lore store card data?
Not by design. Context policy can redact PANs before they reach a model, and the disclosure record proves what was transmitted.
← PREVIOUSNIST CSF 2.0 ALL FRAMEWORKS NEXT →NIS 2
PCI DSS 4.0 · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for PCI DSS 4.0 tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.