PCI DSS 4.0's Future-Dated Requirements Are Now Mandatory
The subset of PCI DSS v4.0 requirements that were 'best practice until' 31 March 2025 are now simply requirements. Expanded MFA is the one most organizations still have work on.
October 21, 2026
v1
2 min
PCI DSS 4.0's Future-Dated Requirements Are Now Mandatory
PCI DSS v4.0 shipped in March 2022 with a deliberate transition design: some requirements were mandatory immediately, and a second set — mostly newly expanded multi-factor authentication requirements and formal, documented targeted risk analyses — were marked as best practice until 31 March 2025. That date has now passed.
The requirement most organizations underestimate
v4.0 requires MFA for all access into the cardholder data environment, not just remote access — a meaningfully broader requirement than v3.2.1's MFA scope. Organizations that treated their existing remote-access MFA as "done" often have real gaps once the requirement is read against v4.0's actual scope.
Explore PCI DSS
Hub overview →
Related Executive Guides
The six goals, twelve requirements, and validation paths behind the payment card industry's security standard — including v4.0's now-mandatory future-dated requirements.
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.
Management-body liability is the detail that changes NIS2 from an IT compliance project into a governance question every board should already be asking about.