For companies handling cardholder data, PCI DSS requires the protection of sensitive payment card data. PCI DSS mandates secure storage of encryption keys, multi-factor authentication (MFA), and strict access controls, all of which relate to secrets security.

Although PCI DSS 4.0 was released in March 2022, certain parts became either required or a suggested best practice in March 2024 and the rest will become required in March 2025. We looked for the parts where we could help current and future customers with their compliance efforts.

PCI DSS 4.0 and Secrets

While most of the changes around passwords have to do with complexity and rotation, one stood out: requirement 8.6.2, which has to do with hard-coded passwords in software. 

GitGuardian's flagship secrets detection service embodies 8.6.2

8.6.2 Passwords/passphrases for any application and system accounts that can be used for interactive login are not hard coded [sic] in scripts, configuration/property files, or bespoke and custom source code. 

This is not just in GitGuardian's wheelhouse, but is the foundation of our original wheelhouse. We have over 300 specific detection engines that catch hard-coded passwords, passphrases, API keys, and more in source code, configuration files, Slack messages, Jira tickets... They are highly tuned and monitored to ensure maximum coverage with minimum false-positive results. And when a secret is detected, we offer workflow management tools to ensure it's handled.

The subparagraphs fall well within our abilities too. In 8.6.2.a, compliance includes interviewing personnel and examining systems to ensure hard-coding credentials in software isn't happening and specifying explicitly that they aren't to be hard-coded going forward. That's a great policy recommendation, but policies don't work consistently without consistent monitoring to ensure they're followed (and to issue corrective action when they're not). 

GitGuardian can scan your existing codebase for issues you need to fix and you can implement automations to integrate GitGuardian into your source code management systems, such as GitHub or Gitlab, to catch and block commits that add hard-coded secrets to the codebase. Our secret-blocking and secret scanning tools mean you don't have to worry if your developers follow the new policy perfectly, because our smart automations are backstopping that policy. 

We won't get wordy about 8.6.2.b because it basically describes what our secrets detectors do.

Understanding PCI DSS 4.0 Password Complexity and Rotation Requirements

PCI DSS 4.0 introduces significant changes to password requirements beyond the hard-coded credential restrictions covered by requirement 8.6.2. The updated standard mandates stronger password complexity rules, including minimum 12-character passwords for system accounts and enhanced authentication mechanisms. Organizations must implement password rotation policies that balance security with operational efficiency, requiring passwords to be changed at least annually or when compromise is suspected.

These requirements extend to all system components within the cardholder data environment (CDE), including databases, applications, and network devices. The standard emphasizes risk-based authentication, allowing organizations to implement adaptive controls based on user behavior and access patterns. For financial institutions and payment processors, these enhanced password requirements work in conjunction with multi-factor authentication (MFA) mandates to create layered security defenses. GitGuardian's secrets detection capabilities complement these requirements by ensuring that even complex passwords meeting PCI DSS 4.0 standards are never exposed in source code or configuration files, maintaining the integrity of your authentication infrastructure.

PCI DSS 4.0 Implementation Timeline and Compliance Deadlines

The phased implementation approach for PCI DSS 4.0 creates critical compliance windows that organizations must navigate carefully. While the standard was published in March 2022, key requirements became mandatory in March 2024, with the final wave of requirements taking effect in March 2025. This staggered timeline particularly impacts password and authentication requirements, as organizations must prioritize which controls to implement first.

Service providers face additional complexity, as certain requirements apply exclusively to their operations and carry earlier effective dates. The authentication requirements in section 8, including the hard-coded password restrictions that GitGuardian addresses, are among the controls that became mandatory in 2024. Organizations that fail to meet these deadlines face substantial penalties, including potential loss of payment processing privileges and fines ranging from $5,000 to $100,000 monthly.

GitGuardian's automated secrets detection provides immediate compliance support for requirement 8.6.2, enabling organizations to identify and remediate hard-coded passwords across their entire codebase before the compliance deadline. This proactive approach helps avoid the costly remediation efforts and potential penalties associated with last-minute compliance scrambles.

PCI DSS and Non-Human Identities

More generally PCI DSS V4.0 covers multiple aspects of Non Human Identity security in other articles:

• 7.1 - Least Privilege Access: Access rights should be limited to the minimum necessary
• 7.2.5 and 8.1.4 - Regular Review and Deprovisioning: Access rights must be periodically reviewed, and unnecessary accounts removed
• 8.2.2 - Unique Identification: Each non-human entity must have a unique ID to ensure accountability
• 8.3.5 - Credential Management: Authentication credentials must be securely managed and rotated regularly
• 10.2.1 - Monitoring and Logging: Activities of machine accounts must be logged and monitored

Many organizations struggle with governing Non-Human Identities, which proliferate in complex IT environments. Without a comprehensive inventory and unique identification of these accounts, ensuring accountability, traceability, and compliance becomes increasingly difficult, heightening the risk of unauthorized access and security breaches. GitGuardian NHI governance solution helps organizations gain full visibility and control over these identities, enabling secure management, enhanced accountability, and streamlined compliance with regulatory standards.

Integration with Existing Security Frameworks and Standards

PCI DSS 4.0's password requirements don't exist in isolation—they must integrate seamlessly with other regulatory frameworks and security standards that organizations typically manage. The authentication controls align closely with NIST Cybersecurity Framework guidelines, ISO 27001 requirements, and SOC 2 Type II controls, creating opportunities for unified compliance approaches rather than siloed security programs.

Organizations subject to multiple regulations can leverage GitGuardian's comprehensive secrets detection to address overlapping requirements across frameworks. For example, the hard-coded password restrictions in PCI DSS 4.0 requirement 8.6.2 directly support NIST guidelines for secure software development and align with SOC 2 controls for logical access management. This convergence allows security teams to implement GitGuardian's solutions once while satisfying multiple compliance obligations.

The integration extends to industry-specific regulations as well. Financial institutions must consider how PCI DSS 4.0 password requirements interact with banking regulations, while healthcare organizations processing payments must balance PCI compliance with HIPAA requirements. GitGuardian's platform supports these complex regulatory environments by providing consistent secrets detection across all systems and applications, regardless of the specific compliance framework driving the requirement.

What are the risks of a non compliance

• Non-compliant organizations can face substantial fines from card networks like Visa, MasterCard, and American Express. These fines can range from $5,000 to $100,000 per month, depending on the severity and duration of non-compliance.
• Additional fines may be imposed in the event of a data breach.
• Organizations may be held legally responsible for breaches that expose cardholder data, leading to lawsuits, settlements, or judgments. This can involve class-action lawsuits from affected customers or regulatory enforcement actions.
• In cases of severe non-compliance, payment processors and banks can revoke an organization’s ability to process credit card transactions, disrupting operations and leading to significant revenue loss.
• Non-compliance with PCI DSS may void cyber insurance policies, leaving an organization financially vulnerable after a security incident or breach.
• Non-compliance can result in an organization having to compensate customers for losses due to fraudulent transactions. In some cases, banks may also demand compensation for the reissuing of compromised cards.

So, yes, we can help

Here’s how GitGuardian helps financial companies to ensure regulatory compliance:

GitGuardian and Finance companies

Transform financial services with robust code security that ensures compliance, rapid delivery, and protects sensitive customer and financial data

Besides being the perfect service to meet the requirements of 8.6.2, we have a number of articles and blog posts about security best practices. From our article on top secrets managers to specific advice like how to handle secrets in Helm, we've got you covered with tips and guidance. With our full suite of services, we can also help you meet the requirements of multiple laws and regulations that are either on the horizon or recently took effect. Book a demo with our knowledgeable and friendly staff.

If you'd like to learn more about how GitGuardian can help you meet your PCI DSS compliance requirements before the 2025 deadline, try our interactive demo.

FAQ