Yes. PCI DSS 12.3.4 requires you to review the hardware and software technologies in use at least every 12 months. The review checks that vendors still ship security fixes promptly, that the technology still supports your compliance, records end of life announcements, and documents a management approved plan for outdated technology. This is not legal advice.
What the text says
The SAQ D wording for 12.3.4 lists four items in the review: analysis that the technologies continue to receive security fixes from vendors promptly, analysis that they continue to support and do not preclude PCI DSS compliance, documentation of industry announcements or trends such as a vendor announcing end of life, and a documented, senior management approved plan to remediate outdated technologies, including those with announced end of life.
Annual review table
| Technology | Fixes still shipped? | Supports compliance? | End of life notice? | Plan and owner |
|---|---|---|---|---|
| Runtime or language version | Check vendor policy | Check | Look up date | Upgrade by a set date |
| Framework | Check release notes | Check | Check | Replace or upgrade |
| Database | Check | Check | Check | Plan |
| Base image or OS | Check | Check | Check | Rebase |
| Key library | Check maintenance activity | Check | Check | Replace if abandoned |
Fill one row per technology in scope. Dates and links matter more than long prose.
How to run it without a scramble
- Start from the software inventory you keep for 6.3.2.
- Add version, vendor support status and any known end of life date.
- Flag anything unmaintained or nearing end of life.
- Write the remediation plan with owner and date, and get management approval.
- Store the review with the date. Repeat within 12 months.
This links to 6.3.3: if a component no longer gets fixes, you cannot install patches that never ship, so the plan matters.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a failing test turns into a fixed control.
Quick check
Does 12.3.4 cover open source libraries?
It covers hardware and software technologies in use. Libraries in your payment applications are reasonable to include, and your assessor can confirm scope.
Who approves the remediation plan?
The text says senior management. Keep the approval on record.
On Safeguard: dependency scanning and asset discovery help build the list of what you run, and compliance and evidence automation keeps dated records. Try the free scan at gold.safeguard.sh/scan.
Sources
Wording is from v4.0. Confirm in the current version.
Last reviewed: 19 October 2026.
