--- title: PCI DSS v4.0 – Where are we now? description: Payment Card Industry Data Security Standard (PCI DSS) is a regulatory requirement for any organization that accepts payment card transactions. It’s a governing standard designed to reduce payment card fraud by increasing controls. image: https://csacyber.com/hubfs/Edited-images-5.png --- [Skip to content](https://csacyber.com/blog/pci-dss-v4.0-where-are-we-now#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search March 20, 2024 5 min read time # PCI DSS v4.0 – Where are we now? ![Cyber Security Associates](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) [Written by: Cyber Security Associates -](https://csacyber.com/blog/author/cyber-security-associates) [Consultancy](https://csacyber.com/blog/tag/consultancy) ![](https://csacyber.com/hubfs/Edited-images-5.png) ##### The long-awaited latest iteration of the Payment Card Industry (PCI) Data Security Standard (DSS) is here! ### What is PCI DSS? Payment Card Industry Data Security Standard (PCI DSS) is a regulatory requirement for any organization that accepts payment card transactions. It’s a governing standard designed to reduce payment card fraud by increasing controls. PCI DSS provides an important baseline that establishes clear technical and governance structures, and it also increases customer confidence that organizations are protecting their credit and debit card data. Overall, though, it aims to reduce the likelihood and potential costs of a data breach. ### What are the key changes from PCI DSS 3.2.1 to PCI DSS 4.0? Launched on 31 March 2022, version 4.0 of the PCI DSS contains several critical (and exciting!) changes to its predecessor (DSS v3.2.1 – released in May 2018). Key changes as highlighted in the PCI DSS v4.0 at a Glance document can be summarised as follows: ##### Organizations must meet the evolving security needs of the payments industry Organizations must continue to iterate and improve their security practices in response to the emerging and developing threat landscape. Some examples of increased security practices within version 4.0 of the DSS include: - Expanded multi-factor authentication (MFA) requirements. - Updated password requirements (no more changing passwords every 90 days!). - New e-commerce and phishing requirements to address ongoing threats (such as MageCart-type attacks).   ##### Promote security as a continuous process Since the release of DSS v3.2, organizations have been required to ensure that security practices are embedded within business-as-usual activities to ensure that security is a cultural and not a ‘tick box’ annual consideration. As with all compliance programs, it is important that activities are proactive in reducing risk opposed to the typically reactive nature of security compliance programs. As we’ve seen throughout the recent pandemic and the upsurge in consumer card and e-commerce fraud, criminals never sleep and making sure compliance is embedded into an organization’s daily activities – and not simply a once-a-year activity – is crucial to protect payment data. Some examples of a more continuous approach within version 4.0 of the DSS include: - Clearly assigned roles and responsibilities for each DSS requirement. - Added guidance to help people better understand how to implement and maintain security. - An option to add further clarification in the reporting template to highlight areas for improvement and provide more transparency for report reviewers.   ##### Increase flexibility for organizations using different methods to achieve security objectives It is not uncommon when consulting with or assessing organizations for PCI DSS compliance to uncover requirements implemented for the sole purpose of achieving or maintaining DSS compliance. SureCloud’s QSA team often hears statements such as “the control is only there because that’s what the PCI DSS says.” It should be no surprise that such organizations frequently struggle to implement and maintain such controls appropriately. By adopting more of a risk-based approach and increasing the flexibility for organizations to secure their environments with controls designed around their business, based on the specific threats they face, merchants and service providers have more options to meet a DSS requirement’s security objective. Of course, such flexibility also supports payment technology innovation. Some examples of increased flexibility within version 4.0 of the DSS include: - Allowance of group, shared, and generic accounts. - Targeted risk analysis empowers organizations to establish frequencies for performing certain activities. - A ‘customized’ approach to implement and validate PCI DSS requirements, providing another option for organizations using innovative or tailored methods to achieve security objectives.   ##### Enhanced validation methods and procedures Many organizations have struggled with PCI DSS validation efforts, often related to the disparate assessment and reporting tools employed across self-assessing and externally-audited entities. This position is improved through adapted validation and reporting options designed to support transparency and granularity for all merchant and service providers. For example, the new validation tools will increase alignment between information reported in a Report on Compliance or Self-Assessment Questionnaire and information summarized in an Attestation of Compliance which will help organizations to keep visibility and monitoring of their compliance activities. ##### Transition period As with any major release of a standard, DSS v3.2.1 will have a two-year sunset period to give organizations plenty of time to undertake any necessary control changes and transition to PCI DSS v4.0 by 31 March 2024. ![](https://surecloudcyber.com/assets/img/blog/transition-period.png) Source: [PCI DSS v4.0 at a Glance](https://www.pcisecuritystandards.org/documents/PCI-DSS-v4-0-At-A-Glance.pdf?agreement=true&time=1648997748777) ##### Implementation of new requirements In addition to the transition period outlined above, organizations will also have an additional year following the transition from v3.2.1 to v4.0 to implement new requirements initially identified within DSS v4.0 as best practice. After 31 March 2025, these requirements will be effective and must be fully considered as part of a DSS assessment. ##### What about your QSA? As for QSA companies, QSAs will be required to undertake additional training to demonstrate their understanding of the new requirements and their appropriate implementation. With differences of opinion on the implementation of PCI DSS requirements a long-standing issue within the QSA community, the newly structured ‘security intent’ of the DSS requirements aims to drive a better relationship between organizations and their QSA, whereby QSAs will be required to understand the intricacies of organizations CDE with the ability to achieve and maintain compliance using ‘customized validations’. ### What steps can I take to streamline compliance activities? As mentioned above, it is important for organizations to align and streamline their approach to achieving and maintaining compliance – and PCI DSS is no different. With the changes introduced within v4.0 of the DSS, organizations can benefit from more of a risk-based approach that will enable them to maximise the cost-effectiveness of their compliance program among other things. Some helpful tips include: ##### 1. Set the right foundations The release of v4.0 brings with it an excellent opportunity to ensure the scope of your cardholder data environment (CDE) is accurate and well-defined. With some significant changes in the management of PCI DSS compliance, it is also a good opportunity to consider engaging a QSA for independent validation and support with understanding your transition path. ##### 2. Keep abreast of changes Now that the new version of the DSS is available, make sure you review it and keep apprised of further clarifications that are likely to come. It also serves as a great opportunity to increase awareness of compliance changes with business stakeholders so that you can plan efficiently and assign relevant budgets. ##### 3. Update and/or align your compliance program! PCI DSS mustn’t be a ‘bolt-on’ to your existing compliance program – it should be an embedded part of your overall compliance program and managed in a simple, cost-effective, and sustainable way. It is recommended that you review the detailed ‘Summary of Changes’ document (linked below) and assess the impact of any changes in version 4 requirements that affect your CDE. ### Where can I find out more? You can find more information about the release within the PCI SSC’s [PCI DSS v4.0 Resource Hub](https://blog.pcisecuritystandards.org/pci-dss-v4-0-resource-hub). For those more familiar with the DSS, one of the key resources is the [PCI SSC’s Summary of Changes document](https://www.pcisecuritystandards.org/documents/PCI-DSS-Summary-of-Changes-v3_2_1-to-v4_0.pdf?agreement=true&time=1648997748762), which contains a detailed explanation of the changes from PCI DSS v3.2.1 to v4.0. Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images%20%281%29.jpg?width=624&height=427&name=Blog%20images%20%281%29.jpg)](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) October 19, 2026 5 min read ### [When the sea becomes the battleground: What the Texas-bound tanker attacks tell us about OT security](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) The recent cyber incidents involving two Texas-bound energy tankers may be one of the clearest... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images.jpg?width=624&height=427&name=Blog%20images.jpg)](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) October 16, 2026 14 min read ### [The attack surface has changed. The fundamentals have not.](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) Note from the author: Fair warning: this turned into a longer post than planned. I’m under no... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL\_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Cyber Security Associates", "url" : "https://csacyber.com/blog/author/cyber-security-associates" }, "dateModified" : "2024-12-07T12:51:47.572Z", "datePublished" : "2024-03-20T04:30:00.000Z", "headline" : "PCI DSS v4.0 – Where are we now?", "image" : [ "https://csacyber.com/hubfs/Edited-images-5.png" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/pci-dss-v4.0-where-are-we-now", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```