TL;DR: Quick Takeaways
- •PCI-DSS 4.0 introduces the Customized Approach as an alternative to prescriptive requirements
- •MFA is now required for all access to the cardholder data environment (CDE)
- •New requirements for e-commerce skimming protection and payment page integrity
- •Version 3.2.1 retired on March 31, 2024 - all entities must now use v4.0
- •Future-dated requirements become mandatory by March 31, 2025
After eight years of PCI-DSS v3.2.1, the Payment Card Industry Security Standards Council released version 4.0 in March 2022, marking the most significant update to the standard since its inception. This isn't just a minor refresh—it's a fundamental reimagining of how organizations can achieve and demonstrate payment security compliance.
Whether you're already PCI-DSS compliant or working toward certification, understanding these changes is critical. The transition period has ended, and all organizations must now comply with v4.0, with additional requirements becoming mandatory in 2025.
In this comprehensive guide, we'll break down every major change, explain what they mean for your organization, and provide a clear migration timeline to ensure you stay compliant.
The Biggest Change: Customized Approach
The most revolutionary addition to PCI-DSS 4.0 is the introduction of the Customized Approach as an alternative to the traditional prescriptive requirements (now called the "Defined Approach").
What is the Customized Approach?
Instead of following specific technical requirements, organizations can now design their own controls that achieve the same security objectives. This is a massive shift from "do this specific thing" to "achieve this security outcome however works best for you."
Defined Approach (Traditional)
- ✓ Follow prescriptive requirements
- ✓ Clear, specific controls
- ✓ Easier to audit
- ✓ Best for most organizations
- ✓ Lower documentation burden
Customized Approach (New)
- ✓ Design your own controls
- ✓ Focus on security objectives
- ✓ Flexibility for innovation
- ✓ Requires extensive documentation
- ✓ Must prove equivalent security
💡 When to Consider Customized Approach:
The Customized Approach is best suited for large enterprises with mature security programs and dedicated compliance teams. You'll need to:
- • Document how your controls meet each security objective
- • Conduct and document a targeted risk analysis
- • Maintain detailed testing procedures
- • Work closely with your QSA to validate your approach
Expanded Multi-Factor Authentication (MFA) Requirements
PCI-DSS 4.0 significantly expands MFA requirements, making it mandatory for virtually all access to the cardholder data environment (CDE).
What Changed in v4.0:
OLD (v3.2.1): Requirement 8.3
MFA required only for:
- • Remote network access to the CDE
- • Administrative access from outside the network
NEW (v4.0): Requirement 8.4 & 8.5
MFA now required for:
- • All access into the CDE (not just remote)
- • All access to systems that can impact security of the CDE
- • All non-console administrative access
- • All remote access (mandatory now, future-dated by March 2025)
8.4.2 - Effective Now
MFA for all access into the CDE from internal networks. No more exceptions for "trusted" internal users.
8.5.1 - By March 31, 2025
MFA for all remote access to the entity's network. This includes VPN, remote desktop, and any remote connectivity.
📋 Action Items:
- ✓ Implement MFA for all CDE access immediately if not already done
- ✓ Plan for organization-wide MFA deployment by March 2025
- ✓ Evaluate MFA solutions that support both internal and remote access
- ✓ Document all system access points and verify MFA coverage
- ✓ Update access control policies and procedures
New E-Commerce and Payment Page Security Requirements
With the rise of web-based payment card skimming attacks (also known as Magecart attacks), PCI-DSS 4.0 introduces new requirements specifically designed to protect payment pages from compromise.
Why This Matters
Payment card skimming attacks have increased by over 200% in recent years. Attackers inject malicious JavaScript into payment pages to steal card data as customers enter it. These new requirements directly address this threat.
Requirement 6.4.3 - Payment Page Integrity
All payment pages must have mechanisms to detect unauthorized changes or tampering. Organizations must:
- • Implement script integrity checks (e.g., Subresource Integrity)
- • Monitor for unauthorized modifications to payment page code
- • Implement Content Security Policy (CSP) headers
- • Detect and alert on changes to HTTP headers
- • Review payment pages at least quarterly for unauthorized scripts
Requirement 11.6.1 - Change Detection for Payment Pages
Implement automated mechanisms to detect and report on any changes to payment page scripts, specifically:
- • Scripts loaded and executed in the customer's browser
- • Changes that could affect the integrity of payment pages
- • Detection must occur at least weekly (or before updates)
- • Alerts must be sent to designated personnel
Implementation Options:
Technical Controls:
- • Subresource Integrity (SRI) tags
- • Content Security Policy (CSP)
- • File integrity monitoring
- • JavaScript sandboxing
- • Third-party script monitoring tools
Commercial Solutions:
- • Magecart protection services
- • Client-side security platforms
- • Web application firewalls with script monitoring
- • Payment page integrity vendors
Need Help with PCI-DSS 4.0 Migration?
Get a free compliance assessment and roadmap for upgrading to PCI-DSS 4.0. Our experts will identify your gaps and provide a clear implementation plan.
Enhanced Encryption and Cryptographic Requirements
PCI-DSS 4.0 updates encryption requirements to address modern threats and deprecated cryptographic protocols.
Requirement 4.2.1 - Strong Cryptography
Key updates to encryption standards:
- • TLS 1.2 or higher required for all transmission of cardholder data
- • SSL and early TLS versions (1.0, 1.1) must be disabled
- • Certificate management and validity monitoring
- • Strong cipher suites only - weak ciphers explicitly prohibited
Requirement 3.5.1 - Key Management Procedures
Enhanced requirements for cryptographic key management:
- • Documented key management procedures and processes
- • Key rotation policies and enforcement
- • Secure key generation using industry-standard methods
- • Key storage in hardware security modules (HSMs) where appropriate
- • Regular review of key custodian access
Requirement 12.3.3 - Cryptographic Architecture
By March 31, 2025, organizations must maintain a documented cryptographic architecture that includes:
- • Inventory of all cryptographic algorithms and protocols in use
- • Details of how algorithms are used and where
- • Plans for upgrading deprecated algorithms
- • Risk analysis for cryptographic implementations
🔐 Recommended Actions:
- ✓ Audit all systems for SSL/TLS versions and disable obsolete protocols
- ✓ Review cipher suites and remove weak or deprecated options
- ✓ Document all uses of cryptography across your environment
- ✓ Implement automated certificate expiration monitoring
- ✓ Create cryptographic architecture documentation before March 2025
Enhanced Logging and Monitoring
PCI-DSS 4.0 significantly expands logging requirements and introduces more specific guidance on what must be logged and how logs should be protected.
Requirement 10.2 - Expanded Audit Log Events
Additional events that must now be logged:
- • All actions by users with administrative or elevated privileges
- • All access to audit logs
- • Invalid logical access attempts
- • All changes to identification and authentication credentials
- • Initialization of audit logs
- • All changes to audit log configurations
- • Creation and deletion of system-level objects
Requirement 10.3 - Log Record Details
Each audit log entry must now include:
- • User identification
- • Type of event
- • Date and timestamp
- • Success or failure indication
- • Origination of event (component, location)
- • Identity or name of affected data, system, or resource
Requirement 10.4.1.1 - Automated Log Review
By March 31, 2025, organizations must implement automated mechanisms to perform log reviews, including:
- • Automated tools to detect and alert on anomalies and suspicious activity
- • Integration with security information and event management (SIEM) systems
- • Real-time or near-real-time alerting capabilities
- • Correlation of logs from multiple sources
Logging Architecture Diagram
PCI-DSS 4.0 Migration Timeline
Understanding the transition timeline is critical for compliance planning. Here's what you need to know:
Key Dates
PCI-DSS v4.0 Released
Initial publication with 2-year transition period announced
v3.2.1 Retirement
PCI-DSS v3.2.1 officially retired - all assessments must use v4.0
Future-Dated Requirements Mandatory
All future-dated requirements become mandatory, including:
- • MFA for all remote network access (8.5.1)
- • Automated log review mechanisms (10.4.1.1)
- • Cryptographic architecture documentation (12.3.3)
- • Enhanced vulnerability management processes
Continuous Compliance
All other v4.0 requirements remain in effect with annual assessments
⚠️ Critical: March 31, 2025 Deadline
If you haven't already implemented the future-dated requirements, you have less than 3 months remaining. These requirements are significant and may require:
- • Budget allocation for new tools (SIEM, MFA, monitoring solutions)
- • Architecture changes (cryptographic systems, logging infrastructure)
- • Policy and procedure updates
- • Staff training on new controls
- • Testing and validation before your next assessment
Other Notable Changes in PCI-DSS 4.0
Beyond the major updates covered above, PCI-DSS 4.0 includes numerous other enhancements:
🔄 Vulnerability Management
- • Expanded scope of vulnerability scans
- • More frequent scanning requirements
- • Enhanced patch management timelines
- • Container and cloud-native security
📝 Documentation Requirements
- • Targeted risk analysis documentation
- • Enhanced network diagram requirements
- • Data flow documentation
- • Role and responsibility matrices
👥 User Management
- • Enhanced password requirements
- • Account review and recertification
- • Application and system account management
- • Privileged account monitoring
🌐 Cloud and Third-Party Services
- • Third-party service provider management
- • Cloud environment security requirements
- • API security considerations
- • Shared responsibility clarifications
🎓 Security Awareness
- • Enhanced training requirements
- • Phishing awareness programs
- • Training frequency and documentation
- • Role-specific security training
⚡ Incident Response
- • Enhanced incident response procedures
- • Incident response team requirements
- • Testing and review requirements
- • Communication plan documentation
Achieve PCI-DSS 4.0 Compliance in 8-12 Weeks
LowerPlane automates 40% of PCI-DSS requirements and provides expert guidance for the rest. Get compliant faster and stay compliant easier.
- ✓Automated evidence collection from 375+ integrations
- ✓Built-in PCI-DSS 4.0 requirement mapping
- ✓QSA coordination and audit readiness support
- ✓Real-time compliance dashboard and gap analysis
Key Takeaways
- 1
PCI-DSS 4.0 introduces revolutionary flexibility with the Customized Approach while maintaining security rigor through outcome-based objectives.
- 2
MFA is now mandatory for virtually all CDE access - plan for organization-wide implementation before March 2025.
- 3
E-commerce businesses must implement payment page integrity monitoring to protect against skimming attacks.
- 4
March 31, 2025 is the hard deadline for all future-dated requirements - start implementation now if you haven't already.
- 5
Automation and modern compliance platforms can reduce the burden of new requirements by 30-50% through integrated evidence collection and monitoring.
Frequently Asked Questions
Can I still use PCI-DSS v3.2.1 for my assessment?
What happens if I don't meet the March 31, 2025 future-dated requirements?
Should I use the Defined Approach or Customized Approach?
How much will upgrading to PCI-DSS 4.0 cost?
Do the new e-commerce requirements apply to my business?
Related Articles
Stay Updated on Compliance Changes
Get expert insights on PCI-DSS, SOC 2, ISO 27001, and other compliance frameworks delivered to your inbox.
No spam. Unsubscribe anytime.