Topic starter
12/02/2026 9:12 pm
TL;DR: PCI DSS requires merchants and service providers to secure cardholder data through 12 controls, including need-to-know access, unique authentication, logging, testing, and policy governance, according to StrongDM’s checklist. For NHI and IAM teams, the practical issue is that those controls now have to cover service accounts, tokens, certificates, and AI agents as well as human users.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “PCI Compliance Checklist: The 12 Requirements (Step-by-Step)”.
By the numbers:
- PCI DSS defines 12 requirements for handling cardholder data and maintaining a secure network.
Key questions
Q: What breaks in PCI DSS 4.0 when service accounts are left outside access governance?
A: The control model breaks at scope, ownership, and review.
Q: Why do machine identities increase PCI DSS compliance risk?
A: Because they can access payment systems without the visibility and approval flow that usually surrounds human accounts.
Q: How should teams measure whether PCI access controls cover NHI estates?
A: Teams should measure whether every identity with cardholder-data reach has an owner, an approved purpose, a review cadence, and an auditable authentication method.
Practitioner guidance
- Define PCI scope for machine identities Inventory every service account, token, certificate, and system account that can reach cardholder data, then assign a named owner and business purpose to each one.
- Rework need-to-know for non-human access Limit NHI access to the smallest system-component set required for the payment workflow and remove broad credentials that were inherited from deployment defaults.
- Bind logging to identity ownership Ensure audit logs capture the specific non-human identity used for each access event so investigators can trace cardholder-data access back to a governed account.
Bottom line: PCI DSS 4.0 pushes access control beyond human logins and into the machine identities that actually move payment data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 9:40 pm
PCI DSS 4.0 exposes the non-human identity gap in payment governance: the standard’s access-control language was never limited to employees, but many programmes still implement it that way. Once cardholder data is reachable by service accounts, tokens, and certificates, the control question shifts from user management to identity governance across the full access chain. The implication is that PCI scoping now depends on whether machine identities are visible, owned, and reviewable as first-class subjects.
A question worth separating out:
Q: What is the difference between human access reviews and NHI access reviews in PCI programmes?
A: Human reviews focus on role, business need, and employment status. NHI reviews must also cover credential type, technical dependency, rotation or expiry behaviour, and whether the identity is still required by the workload or integration that created it in the first place.
👉 Read our full editorial: PCI DSS 4.0 and NHI access control: what teams must rework