Where things stand

PCI DSS v4.0 was published in 2022, and v3.2.1 was retired on 31 March 2024. Version 4.0 introduced a set of future-dated requirements — treated as best practice until 31 March 2025, when they became mandatory. Assessments now test all of them. A limited revision, v4.0.1, clarified wording without adding new requirements.

Themes in v4.0

  • Customised approach — meet a requirement's objective with your own control, backed by a targeted risk analysis
  • Targeted risk analysis — justify the frequency of certain activities rather than relying on fixed intervals
  • Stronger authentication — MFA for all access into the cardholder data environment
  • E-commerce script security — manage and monitor scripts on payment pages
  • Continuous compliance — evidence that controls operate throughout the year

Requirements organisations find hardest

Payment page scripts

Maintain an inventory of every script on payment pages, justify each one and detect unauthorised changes. This addresses skimming attacks that inject malicious JavaScript.

MFA everywhere in the CDE

MFA is required for all access into the cardholder data environment, not only remote and administrative access.

Authenticated internal scanning

Internal vulnerability scans must be authenticated, which surfaces many more findings than unauthenticated scans.

Targeted risk analyses

Activities with flexible frequencies need documented risk analyses that assessors will review.

Password and account management

Longer minimum passwords and stricter management of system and application accounts.

A practical approach

  1. Re-confirm scope — reducing the cardholder data environment through tokenisation reduces everything else
  2. Gap-assess against the full v4.0 requirement set
  3. Prioritise payment page script controls and MFA
  4. Document targeted risk analyses early; they shape other controls
  5. Build evidence collection into everyday operations

Payment aggregators and gateways also face RBI PAPG expectations. Aligning both programmes avoids duplicate effort.

Key takeaways

  • All PCI DSS v4.0 future-dated requirements have been mandatory since 31 March 2025.
  • Payment page script controls, MFA into the CDE and authenticated scanning cause most gaps.
  • Scope reduction through tokenisation remains the most effective control.

Frequently asked questions

What is the difference between v4.0 and v4.0.1?

Version 4.0.1 is a limited revision that clarified wording and guidance; it did not add new requirements.

What is a targeted risk analysis?

A documented analysis that justifies how often certain activities are performed, based on the risks to your environment, which assessors review.

Do small merchants need to comply?

Yes, all entities that store, process or transmit cardholder data must comply, though validation requirements vary by merchant level.

Scope reduction is still the most effective PCI DSS control.

Our regulatory compliance team supports PCI DSS readiness and remediation.