PCI DSS v4.0: New Requirements and What They Mean for You

The Transition to PCI DSS v4.0

PCI DSS version 4.0 was published in March 2022, with version 3.2.1 retired in March 2024 — making v4.0 the current mandatory standard for all organisations that process, store, or transmit cardholder data. Organisations had until March 2025 to comply with "future-dated" requirements introduced in v4.0.

Version 4.0 is the most significant update to PCI DSS in a decade, introducing fundamental changes to compliance philosophy alongside numerous new and updated technical requirements.

The Customised Approach

The most philosophically significant change is the introduction of the Customised Approach as an alternative to the traditional Defined Approach. The Customised Approach allows organisations to meet the intent of a PCI DSS requirement using controls they design and validate, rather than implementing specific prescribed controls.

This requires rigorous documentation — a controls matrix, risk assessment, implementation evidence, and a targeted risk analysis demonstrating how the customised control meets the requirement's stated objective. It requires validation by a Qualified Security Assessor. For most organisations, the Defined Approach remains simpler; the Customised Approach is primarily relevant for sophisticated organisations with architectures that make prescribed controls impractical.

Key New and Updated Requirements

Multi-Factor Authentication

MFA requirements have been significantly expanded. All access to the cardholder data environment now requires MFA — not just remote access as in v3.2.1. All administrative access to any system component within the CDE requires MFA regardless of whether the access is remote or local.

E-commerce Page Integrity

New Requirement 6.4.3 addresses web skimming attacks (Magecart-style attacks) that inject malicious scripts into payment pages to capture cardholder data. Organisations must have a method to confirm payment page scripts are authorised, have integrity verification, and are limited to those necessary for the payment function.

Acceptable controls include Content Security Policy (CSP) headers, Subresource Integrity (SRI) for third-party scripts, and regular automated inventory and integrity verification of all scripts on payment pages.

Phishing and Security Awareness

New requirements mandate security awareness training covering threats relevant to the cardholder data environment, including phishing awareness and authentication best practices.

Password Requirements

Minimum password length has increased from 7 to 12 characters. These changes align PCI DSS with current password security guidance and may require updates to authentication systems.

Targeted Risk Analysis

Where v3.2.1 prescribed specific frequencies for controls like log reviews and penetration testing intervals, v4.0 allows organisations to determine appropriate frequencies based on documented risk analysis — increasing flexibility while requiring formal justification.

Compliance Programme Implications

Organisations that achieved v3.2.1 compliance must assess the gap against v4.0 requirements. The MFA expansion typically requires the most significant implementation effort. E-commerce organisations should prioritise script integrity requirements given the prevalence of skimming attacks.