PCI DSS v4.0
The Payment Card Industry Data Security Standard — a global contractual requirement (not a law) for any organization that stores, processes, or transmits cardholder data. Version 4.0 fully retired v3.2.1 and brought its own newly-mandatory requirements into force through 2024-2025.
PCI DSS is maintained by the PCI Security Standards Council, an industry body founded by the major card brands (Visa, Mastercard, American Express, Discover, JCB) — it's enforced contractually through merchant and processor agreements, not by government regulators. Version 4.0, published in March 2022, replaced version 3.2.1 (which was fully retired on 31 March 2024), and introduced a distinction between requirements that were mandatory immediately and a set of "future-dated" requirements — mostly around expanded multi-factor authentication and more rigorous, documented risk analyses — that became mandatory on 31 March 2025.
Version 4.0 also introduced a formal "customized approach," letting an organization design and document its own way of meeting a requirement's intent (validated by a Qualified Security Assessor) as an alternative to the traditional, prescriptive "defined approach."
Who is impacted
Any merchant, service provider, or other entity that stores, processes, or transmits payment card data — validation requirements scale with transaction volume, from a self-assessment questionnaire for smaller merchants up to an annual on-site assessment by a Qualified Security Assessor (QSA) for the largest ones.
Requirements
Twelve core requirement areas spanning network security, cardholder data protection (including encryption), vulnerability management, strong access control, logging and monitoring, and a formal information security policy — validated either via self-assessment questionnaire or a QSA-led Report on Compliance, depending on merchant/processor level.
Key deadlines
PCI DSS v4.0 published
PCI DSS v3.2.1 retired
v4.0 future-dated requirements become mandatory
Executive guides & research
PCI DSS: The Complete Executive Guide
The six goals, twelve requirements, and validation paths behind the payment card industry's security standard — including v4.0's now-mandatory future-dated requirements.
Glossary
Customized Approach
A PCI DSS v4.0 option letting an organization design its own control to meet a requirement's stated intent, validated by a QSA, as an alternative to the standard's traditional prescriptive ("defined approach") controls.
Qualified Security Assessor (QSA)
An individual certified by the PCI Security Standards Council to perform on-site PCI DSS assessments (Reports on Compliance) for larger merchants and service providers.
Related regulations
Related
Stay ahead of PCI DSS changes
Get Regulatory Alerts the moment something about PCI DSS v4.0 changes — new deadlines, guidance updates, enforcement actions.