PCI DSS v4.0.1
The security baseline for anyone who stores, processes or transmits payment card data.
- Current version
- v4.0.1
- Requirements
- 12
- Future-dated reqs mandatory
- 31 Mar 2025
- Owner
- PCI SSC
What is PCI DSS v4.0.1?
The Payment Card Industry Data Security Standard (PCI DSS) applies to any entity that stores, processes or transmits cardholder data, or that can affect the security of that data. It is maintained by the PCI Security Standards Council.
Version 4.0.1 is the current version. It is a limited revision of v4.0 that clarifies wording without adding new requirements. The future-dated requirements introduced in v4.0 became mandatory on 31 March 2025.
Who needs it
- Merchants that accept card payments, online or in person
- Payment service providers, gateways and processors
- Service providers that host, manage or can affect cardholder data environments
- Fintechs and SaaS platforms that touch card data on behalf of clients
Six goals, twelve requirements
The requirements are grouped under six goals.
Build and maintain a secure network and systems
- 1. Install and maintain network security controls
- 2. Apply secure configurations to all system components
Protect account data
- 3. Protect stored account data
- 4. Protect cardholder data with strong cryptography during transmission over open, public networks
Maintain a vulnerability management program
- 5. Protect all systems and networks from malicious software
- 6. Develop and maintain secure systems and software
Implement strong access control measures
- 7. Restrict access to system components and cardholder data by business need to know
- 8. Identify users and authenticate access to system components
- 9. Restrict physical access to cardholder data
Regularly monitor and test networks
- 10. Log and monitor all access to system components and cardholder data
- 11. Test security of systems and networks regularly
Maintain an information security policy
- 12. Support information security with organizational policies and programs
How compliance is validated
Validation requirements depend on your merchant or service provider level and on what your acquirer or the card brands require.
01
Report on Compliance (ROC)
A detailed onsite assessment performed by a Qualified Security Assessor (QSA), or an Internal Security Assessor where the acquirer allows it. Typically required for higher-volume merchants and service providers.
02
Self-Assessment Questionnaire (SAQ)
A self-assessment for eligible merchants and service providers. The SAQ type (for example A, A-EP, B, C or D) depends on how you accept and handle card data.
03
Attestation of Compliance (AOC)
The formal declaration of your compliance status that accompanies a ROC or SAQ and is shared with your acquirer or customers.
04
ASV scans
Quarterly external vulnerability scans by an Approved Scanning Vendor, alongside internal scans and periodic penetration testing under Requirement 11.
From gap to evidence
- Scope definition and reduction: find where card data actually flows and shrink the cardholder data environment
- Gap analysis against all 12 requirements, including the v4.0 future-dated requirements
- Choosing the right SAQ type and preparing evidence
- PCI scanning, penetration testing and segmentation testing under Requirement 11
- Remediation planning and re-testing before your formal assessment
Frequently asked questions
Does PCI DSS apply if we use a third-party payment gateway?
Yes. Outsourcing payment processing can greatly reduce your scope, but you still need to validate compliance, often through a shorter SAQ such as SAQ A, and manage your provider's compliance status.
What is the difference between a ROC and an SAQ?
A ROC is a detailed assessment documented by a QSA. An SAQ is a self-assessment for eligible entities. Your acquirer or the card brands decide which applies, usually based on transaction volume.
What changed in v4.0.1?
v4.0.1 is a limited revision that corrects and clarifies v4.0. It adds no new requirements. PCI DSS v4.0 was retired at the end of 2024, so assessments now use v4.0.1.
How often do we need to validate?
Compliance is validated annually. Some activities recur more often, for example quarterly internal and external vulnerability scans.
Who performs the formal assessment?
A ROC is performed by a Qualified Security Assessor (QSA) company. Ausec helps you prepare, close gaps and assemble evidence before that assessment.
Working towards PCI DSS?
Start with a gap assessment and a clear, prioritised plan.