SchildmarkPCI DSS v4.0.1
PCI DSS v4.0.1: logging, patching and intrusion detection your assessor can check
Automated log review is mandatory now, critical patches have a one-month clock, and logs must reach back a year. Schildmark reads the logs of the systems in your cardholder data environment, patches them with proof, and exports the records for the assessment period.
What PCI DSS asks for on the technical side
PCI DSS v4.0.1 is the version assessed since v4.0 was retired at the end of 2024, and the requirements that were best practice until 31 March 2025 now count. These are the ones a detection and patching platform touches.
- 5 Anti-malware
- Protect all systems and networks from malicious software, and keep the mechanisms current and logging.
- 6.3.1 and 6.3.3 Vulnerabilities
- Identify vulnerabilities from industry sources and rank them by risk; install patches for critical ones within one month of release.
- 10.2 Audit logs
- Audit logs that capture events such as administrator actions and invalid access attempts, and support detection and forensic analysis.
- 10.4.1.1 Automated log review
- Audit log reviews are performed with automated mechanisms. Required since 31 March 2025.
- 10.5.1 Retention
- At least 12 months of audit log history, the last three months immediately available.
- 10.7 Control failures
- Failures of critical security control systems, such as intrusion detection, change detection, anti-malware and audit logging, are detected, reported and responded to promptly.
- 11.5.1 and 11.5.2 Detection
- Intrusion detection or prevention for network traffic, and a change-detection mechanism, such as file integrity monitoring, that alerts on unauthorised changes to critical files.
- 12.10 Incident response
- Respond immediately to suspected and confirmed incidents, following your incident response plan.
Requirement, what Schildmark does, and the evidence
Detection rules tag their alerts with PCI DSS requirements, and the compliance page counts them per requirement.
| Requirement | What Schildmark does | Evidence it produces |
|---|---|---|
| 5 | Not an anti-malware product. Microsoft Defender for Endpoint and Sophos Central alerts arrive in the same list as everything else. | Alerts with machine and time. |
| 6.3.1, 6.3.3 | Vulnerable packages corroborated against vendor and NVD data every 30 minutes, known-exploited first. Fixes rehearsed, approved, installed in the exact version within maintenance windows, and done only when confirmed fixed. | vulnerabilities_fixed.csv with proof; patch_activity.csv with dates of approval and run, to set against release dates. |
| 10.2, 10.4.1.1 | Logs from machines, firewalls, Microsoft 365, AWS and Google Cloud are read by detection rules as they arrive, which is the automated review; alerts carry the rule and the decoded log line. | controls.csv per requirement; audit_trail.csv for console activity. |
| 10.5.1 | Alerts and network events kept for 7 to 3,650 days; below 365 the page warns that PCI DSS requires 365. | The shortfall, if any, in README.txt. |
| 10.7 | The agents page shows each machine’s state and last check-in, and blocked IPs shows when a block is not in force everywhere. | Console views; the response process is yours. |
| 11.5.1, 11.5.2 | A network sensor raises intrusion detection alerts; the monitoring agent on each machine reports file integrity changes. | Network and file integrity alerts for the period. |
| 12.10 | Block the source on your firewall from the alert, a rule or the analyst; a reason is required, and protected addresses are never blocked. | audit_trail.csv with every response. |
Two things to agree with your assessor: Schildmark keeps alerts and network events, so check whether that satisfies 10.5.1 for every event type in 10.2 or whether a separate log archive is needed; and confirm that the files watched for changes are the ones your assessment calls critical. More on detection, verified patching, the compliance page and evidence pack, and in the documentation: Compliance, Patching.
What Schildmark does not cover
PCI DSS has twelve requirements; most of the standard is outside what a detection platform does.
- Scope and network
- Scoping and segmenting the cardholder data environment, and your firewall rules. Schildmark only adds and removes its own block entries.
- Account data
- Protecting stored account data and encrypting it in transmission (3 and 4).
- Development and access
- Secure software development, access control and multi-factor authentication for your systems (6.2, 7 and 8), and physical security (9).
- Testing
- Internal and ASV vulnerability scans and penetration tests (11.3, 11.4).
- Policies and assessment
- Policies, targeted risk analyses, awareness training, service-provider management, the incident response plan itself, and the assessment by your QSA or SAQ.
How a rollout looks
Usually days, not months. Nothing needs to be installed on your firewalls.
Choose where it runs
Hosted by us, or on one or two of your own Linux servers. Either way, you get a stack of your own.
Enrol the machines
One command per machine on Windows, macOS and Linux, or an MSI for Intune, Configuration Manager or Group Policy.
--patchingadds patching.Connect the rest
Firewall logs, Microsoft 365, AWS and Google Cloud, and the firewalls you block on, set up in the console.
Choose PCI DSS, set 365 days
Turn on PCI DSS on the compliance page, set retention to at least 365 days, and export the evidence pack for the assessment period.
Questions people ask
What does PCI DSS 10.4.1.1 require?
That audit log reviews are performed with automated mechanisms rather than by people reading logs. It was a best practice until 31 March 2025 and is now required. Detection rules that read the logs of every in-scope system and raise alerts are one such mechanism.
When did the future-dated PCI DSS v4 requirements become mandatory?
On 31 March 2025. Until then they were best practice. They include automated log reviews (10.4.1.1) and detecting and responding to failures of critical security control systems for all entities (10.7.2). PCI DSS v4.0 was retired at the end of 2024; v4.0.1 is the version assessed now.
How quickly must critical patches be installed under PCI DSS?
Patches for critical vulnerabilities, as ranked by your process under 6.3.1, within one month of their release (6.3.3). Other applicable patches within a time frame your own assessment sets.
How long must audit logs be kept for PCI DSS?
At least 12 months, with the most recent three months immediately available for analysis (10.5.1). Schildmark warns, naming 10.5.1, when its retention is shorter.
Is Schildmark the anti-malware solution for requirement 5?
No. Schildmark is not an antivirus product. You still run anti-malware on your systems; Schildmark brings the alerts of Microsoft Defender for Endpoint or Sophos Central into the same list as everything else, so they are reviewed and acted on.
Assessment on the calendar?
Tell us which systems are in your cardholder data environment and which firewalls protect it. We will show you what Schildmark covers before your assessor asks. Priced per protected machine.