PCI DSS 4.0 (Payment Card Industry Data Security Standard) is the payment-card data-security standard maintained by the PCI Security Standards Council. It applies to any merchant, processor, or service provider that stores, processes, or transmits cardholder data. Version 4.0 replaced 3.2.1, and 4.0's 51 future-dated requirements became mandatory March 31, 2025.
When did PCI DSS 4.0 fully take effect?
Version 4.0 was released in March 2022. Version 4.0.1 followed in June 2024. The 51 future-dated requirements became mandatory March 31, 2025.
The 64 new requirements in 4.0 broke into 13 effective on initial release plus 51 graced as best practice through March 2025 (PCI SSC blog).
What changed between PCI DSS 3.2.1 and 4.0?
v4 added MFA on every account that touches the CDE, payment-page script monitoring, automated detection on public web apps, and customized validation.
The customized approach lets a service provider define its own controls and prove equivalence to the defined approach, which lifts the ceiling on cloud-native architectures. The full requirement text sits in the PCI DSS v4.0.1 standard at the SSC document library.
Why does PCI DSS show up in security questionnaires?
Buyers ask for AOC or ROC documentation because acquirers and card brands push PCI obligations down to every merchant and service provider.
A service provider that processes more than 300,000 transactions a year for a card brand sits in Level 1 and needs an annual on-site audit by a QSA producing an AOC and ROC. Lower volumes can self-assess via a SAQ. We see most teams under-invest in scoping the cardholder-data environment, which inflates the audit later. The artifacts often pair with SOC 2 reports during procurement.
Related terms
These adjacent terms describe the audit artifacts and assessor roles that travel with PCI DSS 4.0 in any payment-card vendor review.
- AOC - the Attestation of Compliance, the one-page summary of a PCI DSS audit result
- ROC - the Report on Compliance, the long-form audit report a QSA produces for Level 1
- QSA - a Qualified Security Assessor, the auditor authorized to issue an ROC
- TPRM - the third-party risk discipline that surfaces PCI scope on every vendor onboarding