Payment Card Industry Data Security Standard (PCI DSS) 4.0: Software Security and Supply Chain Requirements

IntermediateFree5 modules · 16 lessons · ~2 min

About this course

Payment Card Industry Data Security Standard (PCI DSS) 4.0 makes software teams direct owners of compliance evidence, through secure development and patch timelines in Requirement 6, testing in Requirement 11, and policy and vendor management in Requirement 12. This course walks scope and the Cardholder Data Environment, the defined and customised approaches, future-dated requirements, and the payment page script integrity rules (6.4.3 and 11.6.1) built to stop e-skimming, mapping every control to evidence a Safeguard programme already produces.

What you'll learn

PCI DSS 4.0 Foundations: Structure, Governance and Applicability

The Shape of PCI DSS 4.0
The PCI Security Standards Council and the Assessment Ecosystem
Merchant and Service Provider Levels in Practice

Scope and the Cardholder Data Environment

Defining the Cardholder Data Environment
Segmentation and Reducing Scope
What Pulls a System Into Scope, and How to Keep It Out

Requirement 6: Secure Software Development in Practice

Secure Development Practices and Training
Identifying and Managing Vulnerabilities: Component Inventories and Patch Timelines
Bespoke and Custom Software Versus Third-Party Software
Change Control and Ongoing Protection for Bespoke and Custom Software

01PCI DSS 4.0 Foundations: Structure, Governance and Applicability3 lessons

The Shape of PCI DSS 4.0
The PCI Security Standards Council and the Assessment Ecosystem
Merchant and Service Provider Levels in Practice

02Scope and the Cardholder Data Environment3 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

Requirement 11 Testing, Requirement 12 Governance, and the Customised Approach

Requirement 11: Vulnerability Scanning and Penetration Testing
Requirement 12: Security Policy, Risk Analysis and Third-Party Service Provider Management
The Customised Approach and Future-Dated Requirements in Context

Payment Page Integrity, Evidence and Running the Programme

Payment Page Script Management: Requirement 6.4.3
Change and Tamper Detection: Requirement 11.6.1
Evidence Mapping, Assessment Choices and Running a Continuous Programme

Defining the Cardholder Data Environment

Segmentation and Reducing Scope

What Pulls a System Into Scope, and How to Keep It Out

03Requirement 6: Secure Software Development in Practice4 lessons

Secure Development Practices and Training
Identifying and Managing Vulnerabilities: Component Inventories and Patch Timelines
Bespoke and Custom Software Versus Third-Party Software
Change Control and Ongoing Protection for Bespoke and Custom Software

04Requirement 11 Testing, Requirement 12 Governance, and the Customised Approach3 lessons

Requirement 11: Vulnerability Scanning and Penetration Testing
Requirement 12: Security Policy, Risk Analysis and Third-Party Service Provider Management
The Customised Approach and Future-Dated Requirements in Context

05Payment Page Integrity, Evidence and Running the Programme3 lessons

Payment Page Script Management: Requirement 6.4.3
Change and Tamper Detection: Requirement 11.6.1
Evidence Mapping, Assessment Choices and Running a Continuous Programme2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.