PCI DSS 4.0 with spreadsheets: what works and when to automate

Yes, you can run PCI DSS 4.0 from spreadsheets if your cardholder data environment is small and mostly outsourced. Keep one tab per requirement area, one evidence log, and an owner and due date per task. Move to automation when evidence refreshes, system counts or recurring checks outgrow what people can update by hand.

The PCI Security Standards Council lists PCI DSS v4.0.1 in its document library, alongside a summary of changes from v4.0. Secondary reporting we found says v4.0.1 was a limited revision and that the future-dated requirements of v4.0 became mandatory on 31 March 2025. The council pages we could open did not state those dates, so confirm both in the standard itself.

Which workbook layout works?

Keep it plain. Five tabs cover most small merchants and service providers:

1. Scope. Every system, network segment and person that stores, processes or transmits card data, or can affect its security. Add a column for how you decided it was in or out.
2. Requirements. One row per sub-requirement you must meet: owner, status, control description, evidence link, last tested date, next due date.
3. Evidence log. Date collected, source system, who collected it, file location. One row per artifact.
4. Recurring tasks. Anything the standard expects on a frequency: scans, reviews, log checks, testing. Each with its next due date.
5. Exceptions and vendors. Every compensating control or gap, plus third parties with their responsibility split.

Add a version column. Standards change and so should your sheet.

What is the biggest scoping lever?

Scope. The fewer systems touch card data, the smaller the workbook. Using a hosted payment page or a tokenizing processor can cut what you store and transmit, though you still carry responsibility for how you integrate it. Confirm with your acquirer or assessor how your integration maps to the self-assessment questionnaire you are eligible for, since eligibility rules sit in the council documents.

Where do spreadsheets break?

• Stale evidence. A screenshot from March tells an assessor nothing about October.
• Recurring checks missed. Controls with a frequency need a reminder somebody owns.
• Many systems. Forty servers means forty rows to re-verify each time.
• No history. Overwritten cells erase proof that a control ran in each period.
• Version drift. Three copies of the workbook, three different truths.

The secondary sources we read mention requirements such as automated log review (10.4.1.1), multi-factor authentication for access into the cardholder data environment (8.4.2) and targeted risk analyses for controls with defined frequencies (12.3.1). Check those numbers against the standard before citing them to an assessor. They illustrate the pattern: more controls now need continuous or periodic proof.

When should you automate?

Automate when any of these is true: more than a handful of in-scope systems, evidence needed more often than monthly, more than two people editing the sheet, or an assessor asking for proof across a whole period. Start by automating evidence collection and reminders, not the entire program.

What to do

1. Download PCI DSS v4.0.1 and the summary of changes from the council library.
2. Decide scope first and write the reasoning down.
3. Build the five tabs and assign one owner per row.
4. Fill the recurring tasks tab before anything else, because missed frequencies hurt most.
5. Store evidence in a controlled folder, linked from the log, with dated filenames.
6. Review the workbook monthly and freeze a dated copy each quarter.

Quick check

How Safeguard helps automate this

The software side of PCI evidence is where hand tracking tires first. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, leaving your team time for other work. Technical evidence comes from your actual code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. A qualified assessor still validates your compliance. Book a call to see it.

Sources

• PCI Security Standards Council document library, fetched 18 October 2026 (lists v4.0.1 and the v4.0 to v4.0.1 summary of changes)
• Secondary search results on the 31 March 2025 date and requirement numbers; verify against the standard

Last reviewed: 18 October 2026.