Our Services

PCI DSS 4.0.1 requirement 12.3.4 requires that all software and hardware is supported by the vendor. That sounds easy. Right? It’s not. Let’s discuss.

With PCI DSS 4.0, nine of the requirements were rewritten to allow the assessed entity to define how frequently the control should be completed. While that flexibility sounded great to some folks, others weren’t exactly thrilled—because guess what? It means more paperwork. Every. Single. Year. These nine requirements now require a Targeted Risk Analysis (TRA) to justify the timing you choose. Let’s walk through each one and decide what might be best for your company.