PCI DSS 4.0, released in March 2022 with a transition deadline of March 31, 2024 for most requirements, introduced dozens of changes from version 3.2.1. The biggest shifts include new multi-factor authentication mandates, expanded logging requirements, customized implementation approaches, and stricter password standards. Organizations that handle payment card data must understand these changes now—some requirements already went into effect, while others have deadlines extending into 2025.
The timing matters especially this week. Rank Math PRO WordPress plugin was compromised in a supply chain attack that installed backdoors on websites, and hackers hijacked OVHcloud CLI releases to distribute secret-stealing malware. Payment environments rely on third-party software and dependencies—PCI DSS 4.0's new controls around software integrity and supply chain security directly address these attack vectors.
What are the major structural changes in PCI DSS 4.0?
PCI DSS 4.0 reorganized the standard into 12 requirements that align more closely with security objectives rather than technology implementations. The Council introduced Customized Approaches as an alternative to the traditional Defined Approaches, allowing organizations to demonstrate security outcomes through alternative controls if they can prove equivalent or superior protection.
Every requirement now includes a "Customized Approach Objective" that defines the security outcome. If you implement compensating controls or alternative methods, you must document how your approach meets that objective. This flexibility helps organizations using modern architectures—cloud-native applications, containerized environments, or zero-trust networks—that don't fit the prescriptive controls written for traditional on-premises card environments.
The standard also added future-dated requirements marked as "best practices" until March 31, 2025. After that date, these become mandatory for all assessments. This phased approach gives organizations time to implement complex changes like expanded authentication controls and automated log review mechanisms.
What are the new authentication and access control requirements?
Multi-factor authentication (MFA) expanded significantly. PCI DSS 3.2.1 required MFA only for remote network access into the cardholder data environment (CDE). Version 4.0 extends this:
- Requirement 8.4.2: MFA now required for all access into the CDE, not just remote access (effective March 2025)
- Requirement 8.4.3: MFA required for all administrative access to system components, even if not in the CDE (effective March 2025)
- Requirement 8.3.6: Accounts must be locked after no more than 10 failed authentication attempts (reduced from 15)
Password requirements also tightened. Minimum password length increased from seven to twelve characters or greater, and passwords must be changed if there is any suspicion of compromise. The standard now explicitly requires unique passwords for each system component for administrative access.
Given this week's news about credential stealers disguised as fonts in GitHub repositories and npm packages spreading information stealers, these authentication controls directly defend against the credential harvesting attacks that precede payment system breaches.
What changed for logging, monitoring, and detection?
4.0 dramatically expanded logging and monitoring requirements:
- Requirement 10.4.1.1: Automated mechanisms must be used to perform audit log reviews (effective March 2025)
- Requirement 10.7.2: Failures of critical security control systems must be detected, alerted, and addressed promptly
- Requirement 10.7.3: Failures of critical security control systems must be responded to promptly
Log retention increased for service providers from three months to twelve months immediately available for analysis, with an additional three months archived.
The standard now requires detection and alerting for unauthorized modifications to payment pages and scripts, addressing web skimming attacks (also called Magecart or formjacking). Organizations must implement integrity monitoring or change-detection mechanisms on payment page scripts.
Automated log review replaces manual review for most environments after March 2025. This means implementing SIEM tools, log aggregation platforms, or security analytics that can detect anomalies, failed access attempts, privilege escalation, and unauthorized changes without daily human review of raw logs.
What are the new requirements for software security and development?
PCI DSS 4.0 added an entire section on secure software development:
- Requirement 6.3.2: An inventory of bespoke and custom software must be maintained
- Requirement 6.3.3: All security vulnerabilities must be identified and addressed based on a risk ranking
- Requirement 6.4.3: Software development personnel must receive training annually on secure coding and software security
The standard explicitly requires software integrity checks. Payment applications and critical system components must validate code integrity before execution and detect unauthorized changes. This directly addresses attacks like the Rank Math PRO compromise and AOMEI update server hijacking reported this week.
For organizations that develop payment applications or custom e-commerce platforms, these requirements mean implementing software composition analysis (SCA) tools, dependency scanning, code signing, and secure CI/CD pipelines.
How do the new network segmentation requirements work?
4.0 clarified network segmentation validation:
- Requirement 11.4.5: Internal vulnerability scans must confirm that segmentation controls are operational and effective
- Requirement 11.4.6: Segmentation controls must be tested at least once every six months and after any changes
Penetration testing requirements also expanded. Tests must now include network-layer and application-layer testing, and must validate segmentation controls. If you claim that certain systems are out of scope because of network segmentation, you must prove that segmentation actually prevents access from untrusted networks.
Many merchants discover during assessment that their claimed segmentation doesn't hold up under testing—flat networks, misconfigured VLANs, or forgotten access paths bring additional systems into scope, increasing compliance costs and audit complexity.
What happens to organizations still on PCI DSS 3.2.1?
PCI DSS 3.2.1 officially retired on March 31, 2024. All assessments after that date must use version 4.0. Organizations still operating under 3.2.1 controls are technically non-compliant and risk losing their ability to process card payments if their acquiring bank or payment processor enforces compliance.
The gap between 3.2.1 and 4.0 is not trivial:
- New MFA requirements for CDE access
- Expanded logging and automated log review
- Software security and integrity controls
- Enhanced penetration testing scope
- Stronger password standards
Most organizations need 6-12 months to fully implement 4.0 controls, especially the future-dated requirements coming due in March 2025. Waiting until an assessment deadline creates rushed implementations, incomplete documentation, and failed audits.
What should you do this quarter?
Start with a gap analysis comparing your current controls against PCI DSS 4.0 requirements. Prioritize the March 2025 future-dated requirements:
- Deploy MFA for all CDE access and administrative access to system components
- Implement automated log review using SIEM or security analytics platforms
- Establish software inventory and vulnerability management for custom/bespoke applications
- Test network segmentation through vulnerability scanning and penetration testing
- Document Customized Approaches if you're using alternative controls
Update policies, procedures, and training materials to reflect 4.0 language and requirements. Assessors will look for documentation that explicitly addresses the new requirement text, not 3.2.1 language.
If you're a service provider, review your responsibility matrix with clients. 4.0 added clearer guidance on shared responsibility models, especially for cloud and SaaS environments. Make sure clients understand which controls you provide and which they must implement.
For organizations facing compliance deadlines or struggling with the technical implementation of 4.0 controls, Vici Tech Solutions provides PCI DSS compliance assessments, penetration testing, and secure development services that address the expanded requirements in version 4.0.