Governance and Management of IT

Management must assess and report annually on the effectiveness of internal control over financial reporting (ICFR), and for larger filers the external auditor must attest to that assessment.

Automated financial controls and reports depend on the systems that run them; weak ITGCs (access, change management, operations) undermine reliance on those automated controls.

Identify and understand the laws, regulations and contractual obligations that apply to the organization and its systems; compliance cannot be evaluated until the applicable requirements are known.

A documented process with an assigned owner (often legal or compliance) that tracks regulatory changes, assesses their impact, and records resulting updates to policies and controls.

It protects payment account data (cardholder data and sensitive authentication data) and applies to any entity that stores, processes or transmits that data or can affect its security. Version 4.0 was superseded by the limited revision 4.0.1 in 2024; the requirements are substantively the same.

The CDE is the system components, people and processes that store, process or transmit cardholder data or sensitive authentication data, plus components with unrestricted connectivity to them. Segmentation is not itself required, but effective, tested segmentation isolates the CDE and can reduce the scope of the assessment.