Magebean Logo Magebean
Merchant compliance overlay · Version 4.0.1

Protect payment data without confusing checks with compliance

PCI DSS defines technical and operational requirements for protecting account data. For a Magento merchant, the applicable scope and validation method depend on how payments are integrated, where account data flows, and which systems can affect payment security.

A payment-data security standard

What is PCI DSS 4.0.1?

The Payment Card Industry Data Security Standard provides a baseline of technical and operational requirements designed to protect account data. Version 4.0.1 is a limited revision of version 4.0 that clarifies requirements and guidance; it does not add or remove requirements.

PCI DSS applies to entities that store, process, or transmit cardholder data or sensitive authentication data—and to systems that can affect the security of the cardholder data environment. It is not a Magento checklist and it is not satisfied by running a scanner.

Start with the payment flow

Merchant scope comes before control mapping

A hosted redirect, embedded payment form, direct API integration, saved-card feature, admin workflow, or third-party extension can produce different scope and evidence obligations. Document the payment flow, account-data locations, connected systems, service providers, and components that can influence the payment page before selecting a validation path.

Validation is contextual. The applicable Self-Assessment Questionnaire or assessment method should be confirmed with the merchant’s acquirer, payment brands, or qualified assessor.

Twelve requirement families

Organize mappings around the standard

1–2

Network controls and secure configurations

3–4

Account-data protection and secure transmission

5–6

Malware protection and secure systems and software

7–9

Access control, identity, authentication, and physical access

10–11

Logging, monitoring, and security testing

12

Information security policy and risk management

Payment-page integrity

E-commerce needs explicit script and change control

Requirement 6.4.3 addresses authorization, integrity, and inventory of payment-page scripts. In Magento, relevant evidence can include script sources, extension ownership, deployment controls, content security policy, integrity mechanisms, and a documented business justification.

Requirement 11.6.1 addresses detecting unauthorized changes to payment-page content and HTTP headers as received by the consumer’s browser. The exact applicability and validation obligations depend on the merchant’s payment implementation and assessment method.

Magento-specific evidence

What Magebean mappings can support

Magebean can map observable Magento controls and checks to selected PCI DSS requirements—for example configuration, file permissions, dependencies, security headers, admin exposure, logging signals, payment-page scripts, and change detection. These mappings identify supporting evidence and gaps; they do not establish PCI DSS compliance.

Automated

Evidence that Magebean CLI can collect repeatedly.

Manual

Evidence requiring review, interviews, records, or testing.

Out of scope

Requirements outside Magebean’s observable Magento layer.

From scope to evidence

A practical merchant workflow

  1. 1

    Document the payment flow

    Identify where account data enters, moves, and is handled.

  2. 2

    Confirm scope and validation

    Work with the responsible compliance organization to establish applicable systems and reporting.

  3. 3

    Map applicable requirements

    Connect PCI DSS requirements to Magento controls, service providers, and operational processes.

  4. 4

    Collect evidence

    Combine automated Magebean evidence with manual, organizational, and assessor evidence.

  5. 5

    Remediate and maintain

    Close gaps, approve exceptions where allowed, and repeat verification after change.

Command line automation

Automate PCI-aware Magento evidence

Run PCI-aware checks across checkout, payment-page scripts, card-data exposure, CSP, webhooks, transport security, admin access, and logging signals.

This output provides readiness signals and supporting evidence. It does not determine scope, validate every requirement, or certify PCI DSS compliance.

PCI DSS readiness 
$ php magebean.phar --path=/var/www/magento --profile=pci

Profile: PCI DSS 4.0.1
Baseline: Magento Payment Environment

Automated verification complete

69 checks completed
55 passed
10 need attention
4 high-priority findings

Official references

Use PCI SSC documents and the organization responsible for the merchant’s compliance program as the source of truth for formal scope, requirement wording, validation, and reporting.