PCI DSS v4.0 introduced significant changes to authentication, encryption, and monitoring requirements. What you need to update.
PCI DSS v4.0 became the only active version of the standard in March 2024, with the retirement of v3.2.1, and was itself superseded by the maintenance release v4.0.1 in June 2024. Of the 64 new requirements it introduced, 51 were future-dated best practice until 31 March 2025. That date has passed: every applicable requirement is now scored in every assessment, with no grace period. If you handle payment card data, this guide explains what changed and what you need to do.
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for organisations that store, process, or transmit cardholder data. It is maintained by the PCI Security Standards Council, which is governed by the major card brands, Visa, Mastercard, American Express, Discover, and JCB.
Compliance is validated through self-assessment questionnaires (SAQs) for smaller merchants, or through assessments by a Qualified Security Assessor (QSA) for larger merchants and service providers. The validation level depends on your transaction volume and how you process payments.
Non-compliance can result in fines from card brands, increased transaction fees, and in the event of a breach, liability for fraud losses and the cost of forensic investigation.
Multi-factor authentication (MFA) is now required for all access to the cardholder data environment (CDE), not just remote access. This is one of the most significant changes for many organisations.
Password requirements have been updated, minimum length increased to 12 characters (from 8), and complexity requirements revised. Passwords must be changed at least every 90 days for non-MFA accounts.
Targeted risk analysis is a new concept in v4.0. For certain requirements, organisations can now perform a targeted risk analysis to justify a customised implementation approach, rather than following the prescriptive requirement exactly.
Several requirements that were "best practice" in the initial v4.0 release became mandatory in March 2025. These include requirements for script integrity in payment pages (Requirement 6.4.3), automated log review (Requirement 10.4.1.1), and phishing-resistant MFA for all CDE access.
E-commerce merchants face particularly significant changes under Requirement 6.4.3, which requires all scripts loaded and executed in the consumer browser to be authorised, have their integrity validated, and be inventoried.
Review your current compliance programme against the full list of new requirements and prioritise remediation based on your risk profile and the March 2025 mandatory effective dates.
Firewalls, network segmentation, and secure configuration of all network components in the cardholder data environment.
Encryption of stored cardholder data and all transmission of cardholder data over open, public networks.
Anti-malware software, secure development practices, and regular vulnerability scanning and penetration testing.
Need-to-know access to cardholder data, unique IDs for all users, and MFA for all CDE access (new in v4.0).
Logging of all access to cardholder data, automated log review, and regular testing of security systems.
A comprehensive information security policy addressing all PCI DSS requirements, reviewed annually.
Netru methodology