PCI DSS v4.0: What's Changed
The Payment Card Industry Data Security Standard version 4.0 represents the most significant update since PCI DSS was created. Released in March 2022, with mandatory compliance by March 2025, v4.0 introduces customized validation approaches and 64 new requirements.
Key Changes in v4.0
Customized Approach
Organizations can now design their own security controls to meet each objective, rather than following prescriptive requirements. This requires:
- Documented risk analysis
- Evidence that custom controls meet the security objective
- Third-party validation of the custom implementation
Enhanced Authentication
Requirement 8.3.6: Multi-factor authentication for all access to the cardholder data environment (CDE), not just remote access.
Requirement 8.6.3: Passwords for application and system accounts must be changed at least every 12 months and upon suspicion of compromise.
Targeted Risk Analysis
Organizations must perform targeted risk analyses for requirements where flexibility is allowed:
- Frequency of log reviews
- Scope of vulnerability scans
- Password change intervals
Web Application Security
Requirement 6.4.2: Deploy a web-based attack detection solution (WAF or equivalent) that continuously detects and prevents web-based attacks.
Requirement 6.4.3: All payment page scripts must be authorized, integrity-verified, and inventoried.
Migration Timeline
| Milestone | Date |
|---|---|
| v4.0 published | March 2022 |
| v3.2.1 retirement | March 2024 |
| Future-dated requirements effective | March 2025 |
Implementation Checklist
- Inventory all payment page scripts and implement integrity monitoring
- Deploy MFA across the entire CDE
- Update vulnerability management program with risk-based scanning
- Implement automated log review mechanisms
- Document targeted risk analyses for flexible requirements
SuperClue PCI DSS Module
SuperClue's PCI DSS v4.0.1 framework scan runs 14 external website checks, including a payment page script inventory (Requirement 6.4.3) and payment page change detection (Requirement 11.6.1), with evidence prompts to help you prepare for QSA assessments.