--- title: How comforte's SecurDPS Can Support Your PCI DSS 4.0 Plans description: To articulate the benefits of comforte’s SecurDPS Enterprise Solution for encryption & tokenization, we commissioned Coalfire to run a technical analysis. image: https://insights.comforte.com/hubfs/comforte%20AG_How%20SecureDPS%20Can%20Support%20Your%20PCI%20DSS%204.0%20Plans%20_18.07.png --- [![Hubspot_blog_logo](https://insights.comforte.com/hs-fs/hubfs/Hubspot_blog_logo.png?width=295&name=Hubspot_blog_logo.png)](http://www.comforte.com) [![Subscribe](https://no-cache.hubspot.com/cta/default/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0) [![comforte AG - How comforte's SecureDPS Can Support Your PCI DSS 4.0 Plans](https://insights.comforte.com/hubfs/comforte%20AG_How%20SecureDPS%20Can%20Support%20Your%20PCI%20DSS%204.0%20Plans%20_18.07.png)](https://insights.comforte.com/how-comfortes-securedps-can-support-your-pci-dss-4.0-plans) [Thomas Stoesser](https://insights.comforte.com/author/thomas-stoesser) l Jul 18, 2024 l [PCI DSS](https://insights.comforte.com/tag/pci-dss), [Data Protection](https://insights.comforte.com/tag/data-protection), [Compliance](https://insights.comforte.com/tag/compliance) # How comforte's SecurDPS Can Support Your PCI DSS 4.0 Plans PCI DSS 4.0 is a non-negotiable industry standard for any organization that stores, processes, or transmits cardholder data (CHD) or sensitive authentication data (SAD). But although its requirements are detailed and can be onerous, there are technology solutions available to help streamline the process of compliance, reduce the operational and financial burden, and provide peace of mind for enterprises. To articulate the benefits of comforte’s SecurDPS Enterprise Solution for encryption and tokenization, we commissioned Coalfire Systems to run a [detailed and independent technical analysis.](https://www.comforte.com/fileadmin/Collateral/wp_coalfire_comforte_securdps_pcidssv4.0_tech_assessment.pdf) It offers useful insight into how the product can support PCI DSS 4.0 compliance by reducing the risk and scope of CHD stores in enterprise environments. ## PCI DSS 4.0 and comforte PCI DSS has gone through several iterations since it was first published in 2004, in response to surging levels of card data theft. But the latest is comprised of 12 requirements grouped into six objectives: - Build and maintain a secure network and systems - Protect account data - Maintain a vulnerability management program - Implement strong access control measures - Regularly monitor and test networks - Maintain an information security policy comforte’s SecurDPS offers a data-centric security approach to help protect sensitive data in line with the above objectives. It does this via encryption, format-preserving encryption, tokenization, format-preserving hashing, and masking. And there are capabilities to automatically and continuously discover and classify CHD. The solution can be simply integrated into existing applications via easy-to-use APIs, without changing the record format of the original data. And there are audit and analysis capabilities to help different IT/security stakeholders. ## What Coalfire found Coalfire found the comforte solution to perform well at supporting PCI DSS 4.0 compliance. The report notes the following: *“Coalfire found that SecurDPS solution protected sensitive data using appropriate tokenization, masking and/or hashing strategies. SecurDPS relied on a tokenization mechanism which resided within the SecurDPS Virtual Appliance. Users could tokenize sensitive data or access tokenized data and view the full contents (i.e. Primary Account Number(PAN)) via the REST API. Coalfire observed that the tokenization algorithm used by SecurDPS generated a random output to ensure unique tokens for each instance of sensitive data protected by the solution.”* Coalfire adds that the product’s discovery and classification capabilities “appropriately identified unprotected sensitive data using both vendor and user defined search parameters” – providing a centralized view of all sensitive data by asset type, data source and/or data subject. Role Based Access Controls (RBAC) at the application and/or entity level can be used to enhance security further, it said. Coalfire found comforte’s SecurDPS either meets or supports the following PCI DSS 4.0 requirements: **Requirement 2: Apply Secure Configurations to All System Components** 2.2System components are configured and managed securely. **Requirement 3: Protect Stored Account Data** 3.4 Access to displays of full PAN and ability to copy account data is restricted. 3.5 PAN is secured wherever it is stored. 3.6 Cryptographic keys used to protect stored account data are secured. 3.7 Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented. **Requirement 7: Restrict Access to System Components and Cardholder Data by Business Need to Know** 1. 2 Access to system components and data is appropriately defined and assigned. 7.3 Logical access to system components and data is managed via an access control system(s). **Requirement 8: Identify Users and Authenticate Access to System Components** 8.2 User identification and related accounts for users and administrators are strictly managed throughout an account’s lifecycle. 8.3 Strong authentication for users and administrators is established and managed. 8.6 Use of application and system accounts and associated authentication factors are strictly managed. **Requirement 10: Log and Monitor All Access to System Components and Cardholder Data** 10.2 Audit logs are implemented to support the detection of anomalies and suspicious activity, and the forensic analysis of events. 10.3 Audit logs are protected from destruction and unauthorized modifications. 10.5 Audit log history is retained and available for analysis. **Requirement 12: Support information security with organizational policies and programs** 12.3 Targeted risks to the cardholder data environment are formally identified, evaluated, and managed. 12.5 PCI DSS scope is documented and validated. There’s plenty more detail in the analysis. But at a high-level the message is clear. Merchants, processors, acquirers, issuers, service providers and other organizations looking to streamline their PCI DSS 4.0 compliance processes should consider comforte SecureDPS a valuable ally. --- | Share this:  | [![LinkedIn](https://insights.comforte.com/hubfs/Social%20Icons/linkedin%20icon.png)](https://www.linkedin.com/shareArticle?mini=true&url=https://insights.comforte.com/how-comfortes-securedps-can-support-your-pci-dss-4.0-plans&utm_medium=social&utm_source=linkedin) | [![Bluesky](https://insights.comforte.com/hubfs/Social%20Icons/bluesky_logo.png)](https://bsky.app/intent/compose?url=https://insights.comforte.com/how-comfortes-securedps-can-support-your-pci-dss-4.0-plans&utm_medium=social&utm_source=Bluesky) | ![Twitter](https://insights.comforte.com/hubfs/Social%20Icons/twitter_x_logo-1.png) | [![XING](https://insights.comforte.com/hubfs/Social%20Icons/xing-color2.png)](https://www.xing.com/spi/shares/new?url=https://insights.comforte.com/how-comfortes-securedps-can-support-your-pci-dss-4.0-plans&utm_medium=social&utm_source=xing) | [![Email](https://insights.comforte.com/hubfs/Social%20Icons/email%20icon.png)](mailto:?subject=Check%20out%20https://insights.comforte.com/how-comfortes-securedps-can-support-your-pci-dss-4.0-plans&utm_medium=social&utm_source=email%20&body=Check%20out%20https://insights.comforte.com/how-comfortes-securedps-can-support-your-pci-dss-4.0-plans&utm_medium=social&utm_source=email) | | --- | --- | --- | --- | --- | --- | ## ACI Worldwide has chosen comforte as their strategic partner to support their joint customers on their journey to PCI DSS v4.0 compliance with data-centric security. Click the button below to download the case study: [![Download Case Study](https://no-cache.hubspot.com/cta/default/4026697/64380d94-501a-41fe-b3df-2f5e2d6e0e3c.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/64380d94-501a-41fe-b3df-2f5e2d6e0e3c) ### Related posts ![How Vaultless Tokenization Works in Practice, to Transform Your Business](https://insights.comforte.com/hubfs/comforte%20AG_How%20Vaultless%20Tokenization%20Works%20in%20Practice%20to%20Transform%20Your%20Business_24.07.2025.png) Jul 24, 2025 l [PCI DSS](https://insights.comforte.com/tag/pci-dss) , [Compliance](https://insights.comforte.com/tag/compliance) ### [How Vaultless Tokenization Works in Practice, to Transform Your Business](https://insights.comforte.com/how-vaultless-tokenization-works-in-practice-to-transform-your-business?hsLang=en) In last month’s [blog post](https://insights.comforte.com/is-pci-dss-4.0-slowing-you-down-heres-how-comforte-can-accelerate-your-pci-compliance-journey?hsLang=en) we explained how vaultless tokenization can transform PCI DSS 4.0 compliance from a regulatory burden into a business enabler. Not only does vaultless tokenization reduce the scope and cost of compliance, but it also... [Read more](https://insights.comforte.com/how-vaultless-tokenization-works-in-practice-to-transform-your-business?hsLang=en) ![Is PCI DSS 4.0 Slowing You Down? Here’s How comforte Can Accelerate Your PCI Compliance Journey](https://insights.comforte.com/hubfs/comforte%20AG_Is%20PCI%20DSS%204.0%20Slowing%20You%20Down_%20Heres%20How%20comforte%20Can%20Accelerate%20Your%20PCI%20Compliance%20Journey%20.png) Jun 26, 2025 l [PCI DSS](https://insights.comforte.com/tag/pci-dss) , [Compliance](https://insights.comforte.com/tag/compliance) ### [Is PCI DSS 4.0 Slowing You Down? Here’s How comforte Can Accelerate Your PCI Compliance Journey](https://insights.comforte.com/is-pci-dss-4.0-slowing-you-down-heres-how-comforte-can-accelerate-your-pci-compliance-journey?hsLang=en) With the latest version of PCI DSS, the Payment Card Industry Security Standards Council (PCI SSC) aims to elevate the standards for cardholder data (CHD) security with themes like stronger cryptography, multi-factor authentication, and continuous... [Read more](https://insights.comforte.com/is-pci-dss-4.0-slowing-you-down-heres-how-comforte-can-accelerate-your-pci-compliance-journey?hsLang=en) ![The PCI DSS 4.0 Deadline Has Passed, But There’s Still Time to Play Catchup](https://insights.comforte.com/hubfs/comforte%20AG_The%20PCI%20DSS%204.0%20Deadline%20Has%20Passed_%20But%20There%E2%80%99s%20Still%20Time%20to%20Play%20Catchup.png) Apr 17, 2025 l [PCI DSS](https://insights.comforte.com/tag/pci-dss) , [Compliance](https://insights.comforte.com/tag/compliance) ### [The PCI DSS 4.0 Deadline Has Passed, But There’s Still Time to Play Catchup](https://insights.comforte.com/the-pci-dss-4.0-deadline-has-passed-but-theres-still-time-to-play-catchup?hsLang=en) The deadline for PCI DSS 4.0 has been and gone. But it’s never too late to advance compliance plans. It’s not just about avoiding potentially large fines and other penalties. Following the standard to the letter helps ensure organizations are... [Read more](https://insights.comforte.com/the-pci-dss-4.0-deadline-has-passed-but-theres-still-time-to-play-catchup?hsLang=en) ### Service - [Contact](https://www.comforte.com/contact/) - [About us](https://www.comforte.com/company/) - [Blog](https://insights.comforte.com/) - [Press Releases](https://www.comforte.com/company/press-releases/) - [Career](https://www.comforte.com/company/career/) - [Resources](https://www.comforte.com/resources/) ### Germany comforte AG Abraham-Lincoln-Str. 22 65189 Wiesbaden Germany Phone: + 49 611 93199 00 Fax: + 49 611 93199 05 ### Australia comforte PTY Suite 20, 1 Rivett Road North Ryde NSW 2113 Australia Postal Address: PO Box 1710 Lane Cove NSW 1595 Australia Phone: +61 2 8197 0272 ### USA comforte Inc. 30 Wall Street, 8th Floor New York, NY 10005-2205 USA Phone: +1-646-438-5716 ### Singapore comforte Asia Pte. Ltd. 1 Raffles Place, #19-61 Tower 2  Singapore 048616 Phone: +65 6808 5507 - [Sitemap](https://www.comforte.com/sitemap/) - [Legal Notice](https://www.comforte.com/legal-notice/) - [Privacy Policy](https://www.comforte.com/privacy-policy/) © comforte AG 2026