PCI DSS version 4.0 became the sole active standard in March 2024, replacing v3.2.1. It introduces a new Customised Approach that allows mature organisations to design their own controls to meet stated security objectives, alongside the traditional Defined Approach. Understanding the 12 requirements — and the new future-dated requirements that became mandatory on 31 March 2025 — is essential for every organisation that stores, processes, or transmits cardholder data.

The 12 PCI DSS Requirements

  • Requirement 1: Install and maintain network security controls (formerly "firewalls").
  • Requirement 2: Apply secure configurations to all system components. No vendor-supplied defaults.
  • Requirement 3: Protect stored account data. Minimise storage, use strong cryptography for PANs.
  • Requirement 4: Protect cardholder data in transit with strong cryptography (TLS 1.2+ required).
  • Requirement 5: Protect all systems and networks from malicious software.
  • Requirement 6: Develop and maintain secure systems and software. Address vulnerabilities promptly.
  • Requirement 7: Restrict access to cardholder data by business need to know.
  • Requirement 8: Identify users and authenticate access to system components. MFA required for all access into the CDE.
  • Requirement 9: Restrict physical access to cardholder data.
  • Requirement 10: Log and monitor all access to system components and cardholder data.
  • Requirement 11: Test security of systems and networks regularly. Internal and external penetration tests at least annually.
  • Requirement 12: Support information security with organisational policies and programmes. Includes targeted risk analysis (new in v4.0).

Key Changes in PCI DSS 4.0

  • Targeted Risk Analysis (TRA): Organisations must conduct a TRA to justify the frequency of certain activities (e.g., log reviews, vulnerability scans) rather than following prescriptive timelines.
  • Authentication upgrades (Req. 8): MFA required for all non-console administrative access and all remote access into the CDE. Phishing-resistant MFA strongly recommended.
  • E-commerce security (Req. 6.4.3 & 11.6.1): New requirements for payment page scripts management and change/tamper detection mechanisms — highly relevant for merchants using JavaScript on checkout pages.
  • Customised Approach: Allows organisations to implement alternative controls that meet the stated Customised Approach Objective, subject to auditor review and additional documentation.

Compliance Levels and Assessment Types

  • Level 1 merchants (over 6 million transactions/year): Annual Report on Compliance (ROC) by a Qualified Security Assessor (QSA).
  • Level 2–4 merchants: Annual Self-Assessment Questionnaire (SAQ). Multiple SAQ types exist depending on how you accept cards.
  • Service providers: Level 1 providers require an annual ROC; Level 2 providers an annual SAQ D.

Continuous monitoring of your control environment — patching, log review, vulnerability scanning — is the most effective way to stay PCI DSS compliant between annual assessments.