What is PCI DSS V4.0?
PCI compliance is changing with the introduction of PCI DSS V4.0. In this post (and video – below), we overview what’s happening, when and why…
What is PCI DSS V4.0?
PCI DSS v4.0 is the next evolution latest update to the Payment Card Industry Data Security Standard, the global standard required of any organisation handling card payments.
It’s important and represents the biggest set of changes to PCI DSS since version 3.2.1, which was released in 2018.
Why is it changing?
In the words of the PCI Standards Security Council, PCI DSS v4.0 is being introduced
“to address emerging threats and technologies and enable innovative methods to combat new threats.”
How is it changing?
Examples of the changes in PCI DSS v4.0 given by the PCI Council include:
- Updated firewall terminology to network security controls to support a broader range of technologies used to meet the security objectives traditionally met by firewalls.
- Expansion of Requirement 8 to implement multi-factor authentication (MFA) for all access into the cardholder data environment.
- Increased flexibility for organisations to demonstrate how they are using different methods to achieve security objectives.
- Addition of targeted risk analyses to allow entities the flexibility to define how frequently they perform certain activities, as best suited for their business needs and risk exposure.
When does PCI DSS v4.0 kick in?
As of March 31, 2024, PCI DSS v3.2.1 will be retired, and PCI DSS v4.0 will be the only active version of the standard. Here’s the latest version of the timeline, from the PCI Council:
If you handle payment card data, either as a merchant or processor, you need to be PCI DSS compliant. And for the next two years, until March 2024, you effectively have the option to be compliant with either v3.2.1, as you will be now, or transition to v4.0. Which route to go down will depend on a number of factors.
What should you do about PCI DSS V4.0?
Our recommendation is to contact us (or your chosen PCI DSS QSA Company) and talk through the pros and cons of each approach in order to reach a decision that’s right for you. You can talk to one of our Exeter-based PCI QSAs – just fill in the contact form below, email pci@securious.co.uk or call 01392 247 110 to find out more.
More information:
- Read our ‘Ultimate Guide to PCI Compliance’
- See full details of the updates in the PCI DSS v4.0 Summary of Changes document on the PCI Security Standards Council website
- Learn more about our services as a PCI QSA company
Check out our PCI V4.0 resources page for more articles like this.