What PCI DSS 4.0.1 is
The Payment Card Industry Data Security Standard, version 4.0.1 (version 4.0 was retired at the end of 2024). Applies to Microsoft 365 where it is connected to, or in scope of, the cardholder data environment.
Who asks for it: Organisations that store, process or transmit card data.
What Microsoft 365 can show
25 requirements evidenced by 86 checks. A check maps to a requirement only where its result is genuine evidence for it, so a requirement is listed only when a tenant setting can show it.
Outside Microsoft 365
Network segmentation, card data storage, physical security and testing (requirements 1, 3, 9 and 11) sit outside Microsoft 365.
Readiness is not certification or an audit opinion: it covers only what Microsoft 365 can evidence, and the report says so.
Every requirement and the checks behind it
The mappings were last checked against the published standards in October 2026. Each check links to what it looks at and how to fix it.
| Requirement | Checks that evidence it |
|---|---|
| 2.2.1 Configuration standards are developed, implemented and maintained | |
| 2.2.2 Vendor default accounts are managed | |
| 2.2.4 Only necessary services, protocols and functions are enabled | |
| 3.2.1 Account data storage is kept to a minimum through retention and disposal | |
| 5.2.1 An anti-malware solution is deployed on all system components |
|
| 5.3.1 The anti-malware solution is kept current | |
| 5.4.1 Personnel are protected against phishing attacks |
12 more checks for 5.4.1
|
| 6.3.3 Known vulnerabilities are patched | |
| 7.2.1 An access control model is defined | |
| 7.2.2 Access is assigned by job function with least privilege | |
| 7.2.4 User accounts and access privileges are reviewed every six months | |
| 7.2.5 Application and system accounts are managed with least privilege | |
| 8.2.5 Access for terminated users is immediately revoked | |
| 8.2.6 Inactive user accounts are removed or disabled within 90 days | |
| 8.3.1 All user access is authenticated | |
| 8.4.1 MFA for all non-console administrative access into the CDE | |
| 8.4.2 MFA for all access into the CDE | |
| 8.4.3 MFA for all remote network access |
|
| 8.6.3 Passwords for application and system accounts are protected | |
| 10.2.1 Audit logs are enabled and active | |
| 10.4.1 Audit logs are reviewed at least daily | |
| 10.5.1 Audit log history is retained for at least 12 months | |
| 12.3.4 Hardware and software technologies are reviewed every 12 months | |
| 12.5.1 An inventory of in-scope system components is maintained | |
| 12.10.1 An incident response plan exists and is ready to be activated |
Related frameworks
- Microsoft Cloud Security Benchmark: Microsoft’s own baseline for securing its cloud services.
- Zero Trust: Microsoft’s Zero Trust deployment pillars, from identities to data.
- Microsoft Secure Score: Microsoft’s own score for a tenant, read beside the checks.
- ISO/IEC 27001:2022: The international standard for an information security management system.