Preparing for PCI DSS v4.0: What you need to know

PCI DSS consists of 12 requirements:

Collectively, the requirements PCI DSS sets forth create a multi-layered defense mechanism against potential security threats, ensuring the integrity and confidentiality of cardholder data.

PCI DSS v4.0 is the latest evolution in the information security standard aimed at protecting cardholder data. This update makes significant changes to its predecessor, PCI DSS v3.2.1, including enhancements to existing protocols and new requirements to address emerging threats and technologies.

One of the biggest changes in PCI DSS v4.0

The introduction of a customized approach to “support increased flexibility for organizations using different methods to achieve security objectives.” This customized approach enables organizations to tailor their security measures to fulfill specific operational needs, provided they can effectively demonstrate that those controls meet or exceed PCI DSS v4.0’s intent. It also acknowledges the diversity of technologies and business models within the payments ecosystem, offering organizations a path to compliance that aligns with their unique environments without compromising security.

PCI DSS v.4.0 places greater emphasis on the importance of security as an ongoing process, rather than a periodic exercise. It introduces new requirements for authenticating access to cardholder data, ensuring that entities implement more rigorous controls around user identification and access management. The updated standard also expands the scope of encryption requiring enhanced protection for stored cardholder data and more robust encryption methods for data transmitted across open, public networks.

Another critical update is the focus on the resilience of security practices against emerging threats. PCI DSS v4.0 mandates more comprehensive risk assessment processes, requiring organizations to regularly identify and evaluate threats to their payment environments, thereby ensuring security measures remain effective over time and that entities adapt their approach to accommodate new vulnerabilities and attack vectors.

For additional information about these and other changes, view the chart below or read the PCI Council’s official Summary of Changes from PCI DSS Version 3.2.1 to 4.0.

PCI DSS v4.0 marks a pivotal shift in the payments industry, setting the stage for enhanced security protocols and compliance standards. This version emphasizes not only the importance of protecting consumer data, but also that PCI DSS compliance must be a continuous effort rather than an annual task. With the final implementation deadline set for April 2025, financial institutions, merchants, payment service providers (PSPs), and billers are on a tight schedule to adapt to these changes and create a culture of security.

The journey to PCI DSS v4.0 compliance is complex and will require merchants, banks, billers, and PSPs to make structural changes that go well beyond simply adjusting security controls. Some of the challenges these organizations may face include:

Technological updates: For many organizations, meeting PCI DSS v4.0’s requirements will require overhauling existing systems to accommodate more robust encryption standards, enhanced authentication methods, and stronger data protection mechanisms. These changes demand not only a substantial financial investment, but also sufficient time to implement and test.

Customized approach: While beneficial, the flexibility that PCI DSS v4.0’s customized approach offers also adds a layer of complexity. Organizations are obligated to demonstrate that any customized controls or security measures they implement meet, if not exceed, PCI DSS v4.0’s requirements. This opens up an organization’s security posture to greater scrutiny and requires entities to produce more robust documentation of security systems and controls and conduct more frequent risk analyses. In some instances, it may even necessitate the support of a third-party consultancy to validate that an organization’s customized approach effectively safeguards cardholder data.

Operational impact: Transitioning to a new standard can impact daily operations, with staff training, workflow modifications, and new security protocol implementations disrupting core business processes.

Continuous compliance: The paradigm shift to viewing compliance as an ongoing process rather than a periodic audit requires organizations to invest more heavily in their compliance programs, including implementing continuous monitoring systems, conducting regular risk assessments, and routinely updating security policies and procedures, all of which can be resource intensive.

Regulatory scrutiny: Non-compliance with PCI DSS v4.0 or a breach during the transition could result in regulatory penalties and damage to an organization’s reputation. Balancing the urgency of meeting the April 1, 2025 compliance deadline with the meticulous requirements for proper implementation can pose strategic challenges, which organizations must navigate while maintaining operational efficiency and consumer trust.

To have met the March 31, 2024 deadline, entities would have had to take several critical steps, including:

• Develop a clear understanding of what type of data falls under PCI DSS protection, including cardholder data and sensitive authentication data
• Define their cardholder data environment (CDE) by mapping all systems that store, process, or transmit cardholder data
• Implement strong security protocols to protect their CDE, including firewalls, encryption, and access controls that meet updated PCI DSS v4.0 requirements
• Regularly monitor and test their networks to detect and address vulnerabilities
• Update their information security policy to reflect the new standard and ensure that all staff are fully trained on this updated policy
• Compile up-to-date documentation, including policies, procedures, and records of all monitoring and testing activities, to demonstrate PCI DSS v4.0 compliance

For the next phase, to meet the April 1, 2025 deadline organizations must understand and address their gap remediation to meet the PCI DSS v4.0 requirements within their enterprise. If you use any of the following ACI products, it’s recommended that you consult with your qualified security assessor and reach out to the ACI Worldwide consultants (e.g., professional services, account executive, solution consultant) to begin to upgrade to the PCI DSS v4.0 compliant product versions.

Non-compliance can lead to severe penalties, including hefty fines, increased transaction fees, the termination of bank relationships, legal fees, and reputational damage. Given the severe implications, it’s imperative that organizations treat PCI DSS v4.0 compliance not as a one-time event, but as an ongoing process — one that requires regular reviewing and updating as technology evolves, new threats emerge, and organizational needs change. To understand expectations for their specific environments, organizations are encouraged to work with a qualified security assessor.