Phishing and ransomware: the PCI DSS 4.x controls that actually help

The Canadian Centre for Cyber Security is direct: “Ransomware is the top cybercrime threat facing Canada’s critical infrastructure”, and “phishing is one of the most reported types of fraud in Canada” (National Cyber Threat Assessment 2025-2026). Verizon’s 2026 report found ransomware in 48% of the breaches it analysed, up from 44% the previous year, and a human element in 62% (Help Net Security summary of the 2026 DBIR).

The cost is real. IBM’s 2026 study put the average cost of a data breach in Canada at a record CA$7.11 million (IBM, 2026-07-29). Smaller organizations pay less in absolute terms, but they have less room to absorb it.

PCI DSS was written to protect card data, but several of its v4 requirements are a practical baseline against phishing and ransomware for any organization. Here are five.

1. Anti-phishing mechanisms (requirement 5.4.1)

“Processes and automated mechanisms are in place to detect and protect personnel against phishing attacks” (requirement text). Mandatory since 2025-03-31. In practice: email authentication (SPF, DKIM and DMARC), link and attachment scanning, and a simple way for staff to report a suspicious message.

2. Training that covers phishing and social engineering (requirement 12.6.3.1)

Security awareness training must now include phishing and related attacks, and social engineering. AI makes phishing harder to spot: the Cyber Centre warns that criminals use AI to write “personalized phishing emails at scale with convincing and grammatically correct language” (NCTA 2025-2026). Verizon also found that mobile-centric social engineering, through fake text messages and voice calls, succeeds 40% more often than traditional email phishing (Verizon, 2026). Training should cover these channels, not only email.

3. Multi-factor authentication (requirement 8.4)

A stolen password should not be enough. PCI DSS v4 requires MFA for all non-console access into the cardholder data environment (8.4.2) and for all remote network access (8.4.3). See requirement 8.4.2 explained. Apply the same rule to email, remote access and administrator accounts across the organization.

4. Patch on a clock (requirement 6.3.3)

Attackers routinely exploit known vulnerabilities in internet-facing systems; Verizon now ranks vulnerability exploitation as the top breach entry point (Verizon, 2026). Critical or high-security patches must be installed within one month of release (requirement text). See scanning and patching under PCI DSS 4.0.1.

5. A tested incident response plan (requirement 12.10)

An incident response plan must exist, be ready to activate, and be reviewed and tested at least once every 12 months. For ransomware, the plan should answer in advance: who decides, who isolates systems, how backups are restored, who notifies the payment brands and acquirer, and who handles privacy breach reporting. The Cyber Centre’s ransomware playbook is a solid starting point. In Quebec, a confidentiality incident also triggers obligations under Law 25; see what to record in your incident register.

What PCI DSS does not cover well

Recovery. PCI DSS says little about offline, tested backups, which are among the most important controls for surviving ransomware. Keep at least one backup copy that an attacker with administrator access cannot reach, and test restoring it.

A one-page checklist

• DMARC enforced on your domains.
• A “report phishing” button, and someone who reads the reports.
• Phishing and social engineering in annual training, including text and voice scams.
• MFA on email, remote access and administrator accounts.
• Critical patches within one month.
• Offline backups, with a restore test in the last 12 months.
• An incident response plan with names and phone numbers, tested this year.

Our online PCI DSS Security Awareness course covers phishing and social engineering and supports requirement 12.6. Accel GRC tracks the rest of the program. Contact us to review your readiness.

Sources

• Canadian Centre for Cyber Security: National Cyber Threat Assessment 2025-2026
• Verizon: Vulnerability exploitation top breach entry point, 2026 DBIR finds (2026-05-19)
• Help Net Security: Lessons from the Verizon 2026 DBIR
• IBM: Canada's data breach costs hit record high (2026-07-29)
• Microsoft Learn: PCI DSS Requirement 5 (requirement text)
• Microsoft Learn: PCI DSS Requirement 6 (requirement text)
• Canadian Centre for Cyber Security: Ransomware playbook (ITSM.00.099)
• PCI SSC: Just Published: PCI DSS v4.0.1