Guide
PCI DSS 4.0 and 4.0.1: what changed, and what it means now
PCI DSS 4.0 replaced version 3.2.1, and version 4.0.1 is the current text. So the new requirements that were future-dated became mandatory on 31 March 2025, and every assessment since includes them.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
Why PCI DSS 4.0 matters now
The deadline has passed. Therefore a business that has not reviewed its controls since 2024 is almost certainly behind. Version 4.0.1 introduced 51 new requirements, and assessments now test them. The standard is in the PCI SSC document library.
The changes that catch most businesses
Three requirements cause most surprises, because they touch everyday systems.
| Requirement | What it asks |
|---|---|
| 6.4.3 | Inventory, authorise and justify every script on the payment page. |
| 11.6.1 | Detect unauthorised changes to the payment page. |
| 8.4.2 | Multi-factor for all access into the card environment. |
| 12.10.7 | Respond when card numbers appear where they should not. |
PCI DSS 4.0 readiness check
Tick what is already in place for the new requirements.
Your result appears here as you tick, so you can see what is still open.
The customised approach in PCI DSS 4.0
Version 4.0 added a customised approach, which lets a business meet a requirement's objective in its own way. However, it needs more documentation and assessor work. So most smaller businesses stay with the defined approach.
Continuous evidence rather than an annual scramble
PCI DSS 4.0 expects controls to run all year. For example, one misconfigured port found in a scan can break compliance mid-year. Therefore an annual rush to collect evidence no longer works well.
The practical answer is a calendar. Recurring tasks, such as log reviews and scans, need owners and dates, so evidence builds as the year goes on.
Our role with PCI DSS 4.0
We run gap analyses against version 4.0.1 and help you close what we find. However, we are not a QSA, so the formal assessment is always performed by an independent assessor we can introduce.
If you are unsure where to begin, start with the payment page. Requirements 6.4.3 and 11.6.1 both focus there, so one project often closes two gaps at once.
PCI DSS 4.0 questions
Is PCI DSS 4.0 the same as 4.0.1?
Version 4.0.1 is a limited revision of 4.0, so it is now the version to use.
When did the new requirements become mandatory?
On 31 March 2025, so assessments since then include them.
Does PCI DSS 4.0 affect SAQ A merchants?
Yes, although some script requirements were later removed from SAQ A, so check the current form.
Is version 3.2.1 still valid?
No. It was retired, so assessments use version 4.0.1.
Related guides
Close your PCI DSS 4.0 gaps
Tell us how you take payments. We reply with a written estimate for a version 4.0.1 gap analysis.
Get my written estimate