PCI DSS v4.0

What is PCI DSS v4.0?

The Payment Card Industry Data Security Standard (PCI DSS) v4.0 is the mandatory security standard for any organisation that stores, processes, or transmits payment card data from the major card brands (Visa, Mastercard, American Express, Discover, JCB). Published by the PCI Security Standards Council, it replaced version 3.2.1 with full enforcement from 31 March 2025. Compliance is validated through Self-Assessment Questionnaires (SAQs) or on-site assessments by Qualified Security Assessors (QSAs), depending on transaction volume.

What are the 12 PCI DSS requirements?

PCI DSS v4.0 is organised into 12 top-level requirements grouped under 6 goals:

1. Install and Maintain Network Security Controls: Implement and maintain firewall/security configurations to protect cardholder data
2. Apply Secure Configurations: Do not use vendor-supplied defaults for system passwords and security parameters
3. Protect Stored Account Data: Protect stored cardholder data through encryption, masking, and retention policies
4. Protect Cardholder Data in Transit: Encrypt transmission of cardholder data across open, public networks
5. Protect from Malicious Software: Protect all systems and networks from malicious software
6. Develop Secure Systems and Software: Develop and maintain secure systems and applications
7. Restrict Access by Business Need: Restrict access to cardholder data to authorised personnel only
8. Identify Users and Authenticate Access: Identify and authenticate access to system components
9. Restrict Physical Access: Restrict physical access to cardholder data and systems
10. Log and Monitor All Access: Log and monitor all access to cardholder data and network resources
11. Test Security Regularly: Regularly test security systems and processes including vulnerability scans and penetration tests
12. Maintain an Information Security Policy: Maintain a policy that addresses information security for all personnel

What changed in PCI DSS v4.0?

Version 4.0 introduced several major changes from v3.2.1:

• Customised Approach: A new validation method allowing organisations to meet security objectives using controls different from those in the defined approach, provided they demonstrate equivalent security
• Expanded MFA: Multi-factor authentication now required for all access to the cardholder data environment, not just remote access
• Targeted Risk Analysis: Organisations must perform targeted risk analyses to determine the frequency of certain periodic activities
• Enhanced Authentication: Increased password length requirements (minimum 12 characters) and stricter authentication controls
• 64 New Requirements: Added requirements addressing emerging threats including phishing, e-commerce skimming, and automated security testing