Series · 8 parts
An 8-part series on PCI DSS 4.0.1, OWASP ASVS 5.0 and the OWASP Top 10:2025, written for backend engineers and tech leads who build payment systems.
Part 1
PCI DSS 4.0.1 changes for developers: the 2024-2026 timeline, which of the 12 requirements engineering owns, targeted risk analysis and the customized approach.
10 min read
Part 2
How a payment service provider scopes PCI DSS: CDE and connected-to systems, segmentation, tokenization limits and SAQ D service provider validation.
11 min read
Part 3
OWASP ASVS 5.0 explained for engineers: its 17 chapters, how Levels 1 to 3 were rebalanced, what changed from 4.0.3, and how a team adopts the standard.
10 min read
Part 4
ASVS vs OWASP Top 10: what changed in the Top 10:2025, why it is an awareness list rather than a standard, and how ASVS 5.0 gives you testable requirements.
9 min read
Part 5
Build ASVS authentication for a payments admin API: Argon2id parameters, TOTP replay guards, refresh token reuse detection, CSRF and PCI DSS 4.0.1 conflicts.
10 min read
Part 6
What PCI DSS 6.4.3 and 11.6.1 require, who they apply to after the SAQ A change, and how to implement them with CSP, SRI, an inventory and a weekly check.
9 min read
Part 7
Can OWASP ASVS 5.0 be the secure coding standard for PCI DSS Requirement 6? A mapping table, the gaps ASVS leaves, and the evidence assessors ask for.
10 min read
Part 8
How OWASP Cheat Sheets, WSTG, SAMM and MASVS fit around ASVS, and what the PCI Secure Software Standard v2.0 means for a payments engineering team.
10 min read