# PCI DSS

Source: https://s3msecurity.com/compliance/pci-dss/
Last updated: 2026-11-12

S3M supports seven PCI DSS v4.0.1 requirements with technical controls. ConnGuard NAC, CityGate and APNZone keep card data segments reachable only by approved users and devices, SpotGate separates guest Wi-Fi, EndGuard ties every session to a known user, and SAMI keeps audit-ready records. Requirements are named by number and short title only.

**PCI DSS v4.0.1, the Payment Card Industry Data Security Standard.** Applies to: Organizations that store, process or transmit payment card data, and their service providers. Official text: https://www.pcisecuritystandards.org/document_library/

## How S3M supports it

| Article / control | What it asks | How S3M supports it | Products |
| --- | --- | --- | --- |
| Req. 1.3 | Allow only the traffic the cardholder data environment needs, in and out. | ConnGuard NAC and CityGate let only approved users and devices reach the segments that hold card data, and APNZone keeps ATMs and terminals on private APN in their own segment. | ConnGuard NAC, CityGate, APNZone |
| Req. 1.4 | Control connections between trusted and untrusted networks. | SpotGate keeps guest Wi-Fi traffic apart from the corporate network and from card systems. | Spotgate |
| Req. 1.5 | Reduce the risk from devices that connect both to untrusted networks and to the cardholder data environment. | EndGuard checks the posture of staff devices before and during each session, and ConnGuard NAC isolates devices that fail the check. | EndGuard, ConnGuard NAC |
| Req. 7.2 | Define and assign access by job role, with least privilege. | ConnGuard NAC enforces the role-based network access you define in policy. | ConnGuard NAC |
| Req. 8.2 | Identify every user uniquely and manage accounts through their whole life. | EndGuard binds each device to its user, so every network session carries a known identity. Accounts stay in your identity provider. | EndGuard |
| Req. 10.2 | Record defined events in audit logs with the details needed for detection and forensics. | SpotGate and SAMI keep audit-ready records of network access: who connected, with which device and when. | Spotgate, SAMI |
| Req. 12.5.1 | Keep a current inventory of in-scope system components and what each does. | ConnGuard NAC discovers the devices on each network segment, which feeds this inventory. | ConnGuard NAC |

S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.

Checked against the official text on 2026-11-12.

## Frequently asked questions

### Why does the table show only requirement numbers and short titles?

PCI DSS is published under a license by the PCI Security Standards Council. We name each requirement and describe it in our own words.

### Can S3M reduce PCI DSS scope?

Segmentation can reduce the systems in scope when your assessor accepts it. ConnGuard NAC, CityGate and APNZone support that segmentation; the scoping decision belongs to you and your assessor.

### Does S3M cover the multi-factor and intrusion detection requirements?

No. S3M does not provide multi-factor authentication. It also does not provide intrusion detection or file integrity monitoring, so requirements 8.4, 8.5 and 11.5 need other tools.