PCI DSS 5.4.1: Processes and automated mechanisms are in place to detect and protect personnel against
PCI DSS v4.0.1 control 5.4.1: the requirement in full, the 1 testing procedure an assessor uses to verify it, and the related controls in section 5.4.
Requirement 5: Protect All Systems and Networks from Malicious Software › Section 5.4
Processes and automated mechanisms are in place to detect and protect personnel against phishing attacks.
Summary
Have both process and automated mechanisms working against phishing, not just training.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 5.4.1 | Observe implemented processes and examine mechanisms to verify controls are in place to detect and protect personnel against phishing attacks. |
New in v4.0.1 and easy to misread as more awareness training. The wording is processes and automated mechanisms, and the automated half is the point: 12.6.3 already covers training people, so this control is asking what protects them when training does not work. In practice that is email authentication and filtering: SPF, DKIM and DMARC on your own domains so your brand is harder to spoof, and link or attachment inspection on what arrives. The requirement is to detect and protect, so a mechanism that detects and does not block, or blocks and reports nothing, meets half of it.
What to prepare
- The automated mechanisms in place, named, with their configuration.
- DNS records showing SPF, DKIM and DMARC on domains you send from.
- The process side: how a reported phish is triaged and what happens next.
- Evidence the mechanisms operate, such as blocked-message reporting.
How to implement it
1. Get DMARC to enforcement. A DMARC record at p=none monitors and protects nobody. Moving to quarantine or reject is what stops your domain being used against your own staff and customers.
2. Give people somewhere to report to. The process half of this control is a reporting route that reaches someone, connected to the incident plan at 12.10.1. A button that files into an unread mailbox is not a process.
3. Cover the channels that are not email. Phishing arrives by SMS, chat and phone; the requirement says phishing attacks, not phishing emails.
4. Feed results back into training. Simulation and real-report data is exactly the input 12.6.2 asks the awareness programme to be updated from.
Where this commonly fails
- Training presented as the whole control, when automated mechanisms are named separately.
- DMARC published at p=none and left there.
- A reporting button with no triage behind it.
- Mechanisms on inbound mail only, with nothing protecting the domain from being spoofed outbound.
Related controls
← 5.3.5 · All controls · 6.1.1 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.