What types of compliance documents can ComplianceIQ generate?

ComplianceIQ generates privacy policies, terms of service, employee handbooks, data handling policies, OSHA compliance documents, acceptable use policies, HIPAA compliance docs, information security policies, and more — all tailored to your industry.

Are the generated documents legally valid?

ComplianceIQ generates comprehensive, industry-standard compliance documents informed by current regulations. While they provide an excellent foundation, we recommend having critical documents reviewed by legal counsel for your specific jurisdiction.

How does ComplianceIQ stay current with regulations?

Our AI models are continuously updated with the latest regulatory frameworks including GDPR, CCPA, HIPAA, SOC 2, OSHA, and more. Pro and Enterprise plans include regulatory update alerts.

← All risk registers

PCI DSS 4.0.1 · 22 ROWS · 5×5 SCORING

PCI DSS 4.0.1 Risk Register — 22 Risks for Targeted Risk Analysis (Req 12.3.1)

PCI DSS 4.0.1 introduced Requirement 12.3.1 — a Targeted Risk Analysis (TRA) for any control where the entity uses the 'customised' approach OR where frequency of activity is 'periodically'. This 22-row register is structured to feed your TRA: each row is a real CDE risk mapped to the requirement that mitigates it, with frequency-justification where relevant.

Who this is for

Merchants Level 1–4 (Self-Assessment Questionnaire to ROC)
Service providers approaching annual ROC + AOC
QSAs collecting client TRA evidence under 4.0.1 deadlines (March 31, 2025 cutover)

Methodology

PCI DSS 4.0.1 TRA prescribes structured analysis of threat, impact, likelihood, mitigating factors, and resulting frequency/strength of control. We use 1–5 L×I; controls reduce frequency or scope as documented.

Req 1 — Network

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-01	Untrusted network reaches CDE	Flat network without segmentation	4×5=20	Documented network segmentation w/ default-deny inbound to CDE; annual segmentation pen test.	2×4=8	Mitigate	Network Security	Req 1.2 / 1.3

Req 2 — Configuration

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-02	Default vendor passwords in CDE	Network appliance shipped with admin/admin still in place	3×5=15	Hardening standard for every device class; documented commissioning checklist.	1×4=4	Mitigate	IT	Req 2.2

Req 3 — Stored CHD

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-03	Cardholder data stored unencrypted	App logs containing PAN	3×5=15	PAN tokenised at capture; logs scrubbed; quarterly PAN-discovery scan.	1×4=4	Mitigate	Engineering	Req 3.5 / 3.7
R-04	Cryptographic key compromise	Keys stored alongside encrypted data	2×5=10	HSM-managed keys w/ split-knowledge / dual-control for key custodians; documented KMP.	1×4=4	Mitigate	Crypto Custodians	Req 3.6

Req 4 — Transmission

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-05	CHD intercepted in transit	TLS 1.0 still permitted on legacy endpoint	3×5=15	TLS 1.2+ enforced; quarterly cipher scan; legacy endpoints retired or wrapped.	1×4=4	Mitigate	SRE	Req 4.2

Req 5 — Malware

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-06	Malware on CDE host	AV not deployed on Linux servers	3×5=15	EDR on every CDE asset (Win + Linux); 24/7 SOC monitoring; isolation playbook.	2×4=8	Mitigate	IT	Req 5.2

Req 6 — Secure Dev

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-07	Web-app vulnerability exploited (OWASP Top 10)	No SAST; no pen test	4×5=20	SAST/DAST in CI; annual third-party pen test; WAF in blocking mode.	2×4=8	Mitigate	Engineering	Req 6.4
R-08	Unauthorised production change	Direct DB writes; no PR review	4×5=20	Change-management ticketing; PR + ≥1 reviewer; deploy-log audit trail.	2×4=8	Mitigate	Engineering	Req 6.5

Req 7 — Access

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-09	Excessive CDE access	Role-based access poorly defined	4×5=20	RBAC w/ documented role definitions; least-privilege review quarterly.	2×4=8	Mitigate	IT	Req 7.2 / 7.3

Req 8 — Identity

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-10	Shared admin account in CDE	'pos-admin' shared by 6 staff	4×5=20	Unique IDs per user; named accounts only; PAM for break-glass scenarios.	1×4=4	Mitigate	IT	Req 8.2
R-11	Single-factor admin access	Password-only for admin actions in CDE	4×5=20	MFA required for ALL access into CDE (4.0.1 expanded scope from admin only).	2×4=8	Mitigate	IT	Req 8.4 / 8.5

Req 9 — Physical

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-12	Physical media with CHD lost	Backup tapes shipped without tracking	3×5=15	Bonded courier; chain-of-custody log; encryption mandatory.	1×4=4	Mitigate	Facilities	Req 9.5 / 9.7
R-13	Skimmer on POS terminal	Devices not inspected	3×5=15	Documented POS inspection schedule; tamper-evident seals; staff training.	2×4=8	Mitigate	Store Ops	Req 9.5.1

Req 10 — Logging

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-14	Audit log gap	Auth events not centralised	4×4=16	Centralised SIEM; 1-year online retention; daily review of high-risk events.	2×3=6	Mitigate	SecOps	Req 10.2 / 10.4
R-15	Time-sync drift breaks forensics	Hosts off NTP	3×3=9	Hardened NTP; alert on >5s drift.	1×2=2	Mitigate	SRE	Req 10.6

Req 11 — Testing

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-16	Vulnerability scan stale	Quarterly scans not run	4×5=20	Internal + external (ASV) quarterly scans; on-significant-change re-scan.	2×4=8	Mitigate	Security	Req 11.3
R-17	Pen test stale	Annual pen test missed; segmentation untested	3×5=15	Annual pen test (incl. segmentation per service provider); on-significant-change.	1×4=4	Mitigate	Security	Req 11.4
R-18	Change-detection gap	FIM disabled on CDE	3×4=12	FIM (e.g., Tripwire / Wazuh) on critical CDE files; alerts to SOC.	2×3=6	Mitigate	SRE	Req 11.5

Req 12 — Policy

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-19	Policies stale / unread	Last review > 12 months	4×3=12	Annual policy review; HRIS-tracked acknowledgement; tabletop schedule.	2×2=4	Mitigate	CISO	Req 12.1

Req 12 — TRA

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-20	TRA missing for customised approach	Using 'customised' frequency without documented TRA	4×4=16	TRA per 12.3.1 for every customised / periodic control; refreshed annually.	1×3=3	Mitigate	Compliance	Req 12.3.1

Req 12 — Vendor

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-21	Service provider non-compliant	Vendor's AOC missing or stale	3×5=15	Vendor management programme; AOC review pre-onboarding + annually; documented responsibilities.	2×4=8	Mitigate	Vendor Mgmt	Req 12.8

Req 12 — IR

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-22	Incident response plan untested	Runbook exists but never exercised	3×5=15	Annual IR tabletop; on-call rota; stakeholder comms tree; post-mortem template.	2×4=8	Mitigate	SecOps	Req 12.10

Common pitfalls auditors flag

Skipping the TRA — 4.0.1 makes this mandatory for any 'customised' approach control AND any control with 'periodically' frequency.
Forgetting the 4.0.1 expanded MFA scope — MFA is now required for ALL access into the CDE, not just admin access.
Treating segmentation as proven by topology diagram — Requirement 11.4.5 requires testing segmentation effectiveness annually.
Letting tokenisation creep into PAN storage in logs / support tickets / debugging snapshots.
No documented TRA refresh cadence — auditors look for a date and a justification.

FAQ

Is the TRA required for SAQ-A merchants?

Customised approach controls trigger TRA universally. Most SAQ-A merchants don't use customised approach, so TRA may not apply — but if you have ANY 'periodically' frequency control, TRA is required regardless of SAQ level.

When did 4.0.1 transition from optional to required?

March 31, 2025 was the cutover. Future-dated requirements (with 'best practices until') including 12.3.1 are now mandatory.

How does this register relate to Requirement 12.3.3 (cryptographic risk analysis)?

12.3.3 is a specialised TRA covering cryptographic suites & protocols. This register includes the high-level crypto risks; pair it with a dedicated crypto-suite TRA covering algorithm strength, key length, expiry.

Will this satisfy a QSA?

It's strong baseline evidence. Customise to your actual CDE — your network diagram, your data flows, your service providers — and walk it with your QSA at the start of the engagement.

Now run a free PCI DSS 4.0.1 audit on your existing policy

Drop your current policy or describe your environment — ComplianceIQ scores every clause against the framework and tells you which register rows are actually mitigated.

Start free PCI DSS 4.0.1 audit