Much PCI DSS 4.0 evidence can be collected automatically from systems you already run: access lists from your identity provider, configuration from cloud accounts, change history from source control and scan results over time. Policies, risk decisions and payment page script justifications still need a named human to write and approve them.
What counts as evidence?
Your assessor wants proof that a control exists and that it operated over the period. A policy document shows intent. A dated export of an access review shows operation. The second kind is the one that can be automated, and it is also the one that ages fastest.
The PCI Security Standards Council lists PCI DSS v4.0.1 in its document library. The future dated requirements from v4.0 became required after 31 March 2025, per the Council, so assessments now include them.
A three bucket sort
Take your last assessment's evidence request list and sort every line into one bucket.
Automatic. A system can produce the artifact on a schedule with no human step.
- Admin and privileged access lists from identity and cloud accounts
- Branch protection and code review settings from source control
- Encryption and logging settings from cloud configuration
- Vulnerability scan results with dates, over time
- Backup job results
Semi automatic. A system produces the data, a human annotates or approves it.
- Access reviews, where the list is generated and a manager signs off
- Exceptions to a hardening baseline, with a reason and an expiry date
- The inventory of payment page scripts, where the tool lists them and a person records why each is needed
Manual. Judgment or paper only.
- Policies and their annual reviews
- Scope decisions and network diagrams
- Vendor due diligence
- Incident response exercises
Most teams find the automatic bucket is smaller than the vendor pitch suggested and still large enough to remove weeks of effort.
How do you set it up?
- Export the evidence request list from your last assessment.
- Sort each line into the three buckets above.
- For automatic lines, name the system of record and connect it.
- Decide a collection schedule and a retention period. Evidence for the whole assessment period must still exist at the end of it.
- For semi automatic lines, set a calendar owner and a due date.
- For manual lines, set a review date and keep the approved version in one place.
- Before the assessor arrives, sample five items and trace each to a dated file. Fix gaps you find.
Payment page scripts deserve their own line
The Council describes requirements 6.4.3 and 11.6.1 as aimed at e-skimming. Scripts on payment pages must be authorized, checked for integrity and monitored for tampering. Evidence here is a living inventory plus alerts on change. A spreadsheet updated once a year will not show monitoring. SAQ A merchants follow a different route, described by the Council, so check which questionnaire applies to you.
What do tools claim, and what is fair to claim?
Safeguard's compliance documentation says automated tests are mapped for PCI DSS, along with SOC 2, ISO/IEC 27001, the HIPAA Security Rule and NIST CSF 2.0, using systems you connect. It also says each connector page states whether that connector collects evidence automatically. Safeguard does not certify you, and it does not replace a qualified assessor. Use it as a way to gather and keep evidence, and let your assessor decide what satisfies a requirement.
Quick check
Can evidence collection be fully automated?
No. Policies, scope decisions and risk judgments need a human. Automation covers the repetitive system data, which is a large share of the request list.
How long should evidence be kept?
At least long enough to cover the assessment period, and longer if your assessor or contracts ask. Confirm the retention period with your assessor.
Sources
- PCI Security Standards Council document library
- PCI SSC blog: e-commerce requirements effective after 31 March 2025
- Safeguard docs: compliance
- Safeguard docs: connectors
Last reviewed: 18 October 2026.
