PCI DSS 4.0's Future-Dated Requirements Are Now Mandatory

PCI DSS v4.0 shipped in March 2022 with a deliberate transition design: some requirements were mandatory immediately, and a second set — mostly newly expanded multi-factor authentication requirements and formal, documented targeted risk analyses — were marked as best practice until 31 March 2025. That date has now passed.

The requirement most organizations underestimate

v4.0 requires MFA for all access into the cardholder data environment, not just remote access — a meaningfully broader requirement than v3.2.1's MFA scope. Organizations that treated their existing remote-access MFA as "done" often have real gaps once the requirement is read against v4.0's actual scope.