What Is PCI DSS 4.0? Key Changes and Requirements Explained

Payment card fraud continues to evolve, and so do the security standards designed to prevent it. That’s why the Payment Card Industry Security Standards Council (PCI SSC) introduced PCI DSS 4.0, the most significant update to the Payment Card Industry Data Security Standard in years.

While many organizations view PCI compliance as an annual audit exercise, PCI 4.0 reflects a broader shift in cybersecurity. The standard places greater emphasis on continuous security, risk-based decision making, and validating that security controls are actually effective—not simply that they exist.

For organizations that store, process, or transmit payment card data, understanding the new PCI 4.0 requirements is essential for maintaining compliance while strengthening overall security.

What Is PCI DSS 4.0?

PCI DSS is the global security standard that protects payment card data across merchants, service providers, financial institutions, and other organizations involved in payment processing.

PCI DSS 4.0 was developed to address today’s evolving threat landscape while providing organizations with greater flexibility in how they achieve security objectives. The updated standard introduces new requirements, modernizes existing controls, and encourages organizations to continuously evaluate and improve their security programs rather than treating compliance as a once-a-year exercise.

Rather than replacing fundamental security principles, PCI 4.0 builds on them by recognizing that today’s payment environments are more distributed, cloud-enabled, and interconnected than ever before.

Why Was PCI DSS Updated?

Cyber threats have changed dramatically since previous versions of the standard.

Organizations now face increasingly sophisticated ransomware attacks, cloud security challenges, third-party risks, and attacks targeting web applications and payment pages. At the same time, businesses are adopting new technologies that require security standards to be more flexible without sacrificing protection.

PCI DSS 4.0 was designed with several key objectives in mind:

• Continue meeting evolving payment security needs
• Promote security as an ongoing business process
• Increase flexibility through customized implementation approaches
• Strengthen validation methods to ensure controls work as intended

The result is a standard that moves beyond checkbox compliance toward measurable cybersecurity outcomes.

Key PCI 4.0 Requirements and Changes

Although PCI DSS still contains its familiar twelve high-level security requirements, many individual controls have been updated or expanded. Some of the most significant PCI 4.0 requirements include:

Stronger Authentication Requirements

Authentication receives significantly more attention under PCI 4.0.

The updated standard expands multi-factor authentication (MFA) requirements beyond administrative access. Organizations must ensure MFA is implemented wherever required and managed appropriately to reduce the risk of credential compromise.

PCI 4.0 also strengthens password management expectations and emphasizes secure authentication throughout the cardholder data environment.

Enhanced Risk-Based Security

One of the biggest philosophical changes is the increased emphasis on documented risk analysis.

Rather than applying identical security controls everywhere, organizations are expected to evaluate risks, justify certain implementation decisions, and periodically reassess those decisions as environments evolve.

This helps organizations build security programs that better reflect their actual business risks instead of relying solely on prescriptive controls.

Greater Focus on Payment Page Security

E-commerce attacks have become increasingly common, particularly those involving malicious JavaScript or payment page tampering.

PCI 4.0 introduces new requirements around:

• Maintaining an inventory of payment page scripts
• Authorizing scripts before deployment
• Protecting script integrity
• Detecting unauthorized changes

These controls are designed to reduce the risk of web skimming attacks that can compromise payment card information.

Increased Emphasis on Continuous Security

Previous versions of PCI DSS often resulted in organizations focusing heavily on annual assessments.

PCI 4.0 shifts toward ongoing monitoring by encouraging organizations to continuously validate that security controls remain effective over time.

Examples include:

• Continuous log monitoring
• Ongoing vulnerability management
• Regular review of security controls
• Periodic validation that implemented safeguards continue to function as intended

This reflects the reality that security cannot be maintained through annual compliance activities alone.

Greater Flexibility Through the Customized Approach

One of the most discussed additions to PCI 4.0 is the Customized Approach.

Rather than requiring every organization to implement controls in exactly the same way, PCI 4.0 allows organizations to implement alternative security controls if they can demonstrate those controls achieve the required security objective. This differs from compensating controls, which address situations where a standard requirement cannot be met due to legitimate constraints.

For organizations with mature security programs, this provides greater flexibility while maintaining strong security outcomes.

PCI 4.0 Requirements for Penetration Testing

Penetration testing remains one of the most important technical validation requirements under PCI DSS.

Unlike vulnerability scanning, which identifies known weaknesses, penetration testing validates whether attackers could actually exploit vulnerabilities to compromise the cardholder data environment.

PCI DSS requires organizations to conduct penetration testing:

• At least annually
• After significant changes to the cardholder data environment
• Against both internal and external attack vectors
• To validate network segmentation if segmentation is used to reduce PCI scope

Segmentation testing is particularly important because ineffective segmentation can dramatically expand the systems considered in scope for PCI compliance.

As IS Partners frequently advises clients, penetration testing should do more than satisfy an audit requirement. It should provide meaningful insight into whether security controls would withstand real-world attacks.

What Organizations Should Do to Prepare

Many organizations approach PCI compliance by reviewing individual requirements shortly before an assessment.

A more effective strategy is to treat PCI DSS as part of a broader cybersecurity program.

Organizations preparing for PCI 4.0 should consider the following priorities:

• Review the scope of the cardholder data environment (CDE) and validate segmentation.
• Assess current controls against the latest PCI 4.0 requirements.
• Document risk analyses where required.
• Review authentication and MFA implementations.
• Strengthen vulnerability management and penetration testing programs.
• Evaluate payment page security controls for web applications.
• Develop a roadmap for any new or enhanced requirements.

Organizations that start early typically have greater flexibility to prioritize improvements, reduce compliance risk, and avoid last-minute remediation efforts.

PCI 4.0 Compliance Is About More Than Passing an Audit

The most successful organizations recognize that PCI DSS is ultimately a security framework, not simply a compliance requirement.

PCI 4.0 encourages organizations to continuously evaluate whether their security controls remain effective as technologies, threats, and business operations evolve. That mindset leads to stronger protection for payment card data while making compliance assessments significantly less stressful.

Working with experienced PCI professionals can help organizations interpret complex requirements, validate technical controls, and build a sustainable compliance program rather than scrambling before each assessment. IS Partners provides end-to-end guidance through every stage of the process.

Our Qualified Security Assessors (QSAs) help organizations:

• Perform PCI DSS readiness assessments and gap analyses
• Conduct formal PCI DSS assessments
• Validate cardholder data environment scope
• Perform penetration testing and segmentation testing
• Identify remediation priorities before assessments
• Build practical, sustainable compliance programs aligned with business objectives

PCI compliance shouldn’t be treated as an annual checkbox exercise. With the right strategy and experienced guidance, organizations can use PCI 4.0 as an opportunity to improve both compliance and their overall cybersecurity posture.

About The Author

Chris Gould

Chris Gould is a seasoned cybersecurity professional with a decade of experience working in various information security roles for major organizations in the finance and information technology industries. At I.S. Partners, Chris is a Senior Security Consultant focusing primarily on providing expert level ISO 27001 and PCI DSS QSA-related assurance and advisory services for I.S. Partners’ clients. Originally from Philadelphia, PA, he now resides in central Florida, where he continues to drive security and compliance initiatives in highly regulated
environments.

With multiple years of direct experience working with ISO 27001 and the Payment Card Industry Data Security Standard (PCI DSS), Chris has played a key role in ensuring data security and regulatory compliance across multiple organizations. He holds several industry-recognized certifications, including PCI Qualified Security Assessor (QSA), Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Payment Card Industry Professional (PCIP), and Certified CMMC Professional (CCP). He was also formerly a PCI Internal Security Assessor (ISA).

Chris’s expertise spans security assessments, risk management, and system architecture, helping organizations strengthen their security posture while meeting compliance requirements in an evolving threat landscape.