PCI DSS v4.0.1

Prove the Person. Protect the Data.

Support PCI DSS 4.0.1 compliance with phishing-resistant MFA

PCI DSS 4.0.1 expands multi-factor authentication across administrative access, remote access, and the cardholder data environment. TokenCore™ provides FIDO2-certified, hardware-bound authentication that proves the authorized person before access is granted.

No shared secret. No code to phish. No fallback.

Contact Sales Download Guide

The Shift

The Standard Moved to Identity.

Why authentication has become a critical PCI DSS control

PCI DSS 4.0.1 treats authentication as a primary control, not a checkbox. As attacks target credentials directly, the standard now expects proof of the person behind the access.

From 3.x to 4.0.1

The standard evolved from broad guidance to explicit authentication mandates. Identity is now named as the control that has to hold.

Expanded MFA Expectations

MFA now reaches administrative access, remote access, and the cardholder data environment. The scope widened. The bar rose.

Credential-Based Attacks

Stolen and phished credentials are the way in. When the login is the target, the login has to prove the human.

Identity as a Primary Control

Access starts with identity. PCI DSS 4.0.1 makes that the point where the environment is defended.

The Requirements

Four Requirements. One Answer.

What are the MFA requirements in PCI DSS 4.0?

PCI DSS 4.0.1 sets specific authentication requirements across privileged, workforce, and remote access. Each one asks the same thing: prove the person.

Requirement 8.4.1 Administrative Access

MFA for the accounts that hold the most privilege.

Administrative accounts
Privileged users
PAM environments

Requirement 8.4.2 Access Into the Cardholder Data Environment

Every workforce login into the CDE tied to a verified individual.

Workforce authentication
Access controls
User identity verification

Requirement 8.4.3 Remote Access Requirements

Remote and third-party access proven, not assumed.

VPN access
Remote workforce
Contractors
Third-party access

Requirement 8.5.1 MFA Security Requirements

MFA that resists replay and cannot be bypassed.

Replay resistance
MFA bypass prevention
Multiple factor validation
Authentication assurance

The Guide

Map Every Requirement.

Download the PCI DSS Authentication Requirements Mapping Guide

The mapping guide lines up PCI DSS 4.0.1 authentication requirements against phishing-resistant FIDO2 controls, requirement by requirement. A practical reference for teams building toward compliance.

Download the Guide

The Support

Strong Authentication. Proven Access.

How TokenCore™ supports PCI DSS authentication controls

PCI DSS emphasizes strong authentication, access control, and evidence. TokenCore™ provides phishing-resistant authentication that meets those objectives at the identity layer.

Hardware-Bound Authentication

The credential lives in the hardware and never becomes a reusable secret.

Device-bound identity
Credential theft prevention
Hardware assurance

Match-on-Chip Biometrics

The fingerprint is matched on the device and never leaves it.

On-device verification
Fingerprint authentication
Biometric privacy

Strong Cryptographic Protection

Keys are generated and held in a tamper-proof secure element.

EAL5+ secure element
Private key protection
FIDO2 security architecture

Audit-Ready Identity Events

Every access event ties to a verified individual, ready for evidence.

Authentication logging
Traceability
Evidence collection

Third-Party Access Protection

Contractor and provider access held to the same proven standard.

Contractors
MSPs
TPSPs

Risks of OTP-Based Authentication

A one-time code can be entered by anyone who intercepts it. A shared secret is a secret an attacker can hold too.

Push Fatigue and Social Engineering

Approval prompts can be worn down until someone taps yes. TokenCore™ has nothing to approve and nothing to pressure.

Adversary-in-the-Middle Attacks

Relay pages capture codes in real time and pass them through. There is no code to relay when the fingerprint stays on the device.

How FIDO2 Delivers Phishing Resistance

The credential is bound to the hardware and the person. Nothing to phish, nothing to reuse, nothing to send.

See It in Action

Make Identity Absolute

Strengthen authentication controls for PCI-regulated environments

See how TokenCore™ deploys phishing-resistant authentication that supports PCI DSS authentication requirements and closes the credential-based attack path.

Talk to Sales