{"id":1470,"date":"2026-10-19T09:00:00","date_gmt":"2026-10-19T03:30:00","guid":{"rendered":"https:\/\/securis360.com\/blog\/?p=1470"},"modified":"2026-10-15T10:24:43","modified_gmt":"2026-10-15T04:54:43","slug":"pci-dss-4-requirements-explained","status":"publish","type":"post","link":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/","title":{"rendered":"PCI DSS 4.0 Requirements Explained: What Changed and What You Must Do"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">If your organization stores, processes, or transmits payment card data, PCI DSS isn&#8217;t optional. Version 4 of the standard was the biggest overhaul in over a decade, and since 31 March 2025 every one of its new requirements has been mandatory. Organizations that treated the &#8220;future-dated&#8221; items as something to deal with later now find them squarely in scope at every assessment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This article explains PCI DSS 4.0 requirements in plain language: the twelve core requirements, what changed from version 3.2.1, the requirements that cause the most difficulty, and how to approach compliance in a way that improves security rather than just passing an audit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PCI DSS 4.0 and 4.0.1: Where Things Stand<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Date<\/th><th>Milestone<\/th><\/tr><\/thead>\n<tbody>\n<tr><td>March 2022<\/td><td>PCI DSS v4.0 published<\/td><\/tr>\n<tr><td>31 March 2024<\/td><td>PCI DSS v3.2.1 retired<\/td><\/tr>\n<tr><td>June 2024<\/td><td>PCI DSS v4.0.1 published as a limited revision with clarifications and no new requirements<\/td><\/tr>\n<tr><td>31 December 2024<\/td><td>PCI DSS v4.0 retired; v4.0.1 becomes the only active version<\/td><\/tr>\n<tr><td>31 March 2025<\/td><td>All future-dated requirements become mandatory<\/td><\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">When people say &#8220;PCI DSS 4.0&#8221; today, they&#8217;re usually referring to the v4.x standard as a whole, which in practice means v4.0.1. The PCI Security Standards Council explains the revision in its <a href=\"https:\/\/blog.pcisecuritystandards.org\/just-published-pci-dss-v4-0-1\" target=\"_blank\" rel=\"noopener noreferrer\">announcement of v4.0.1<\/a>, and the full standard is available from the <a href=\"https:\/\/www.pcisecuritystandards.org\/document_library\/\" target=\"_blank\" rel=\"noopener noreferrer\">PCI SSC Document Library<\/a>. In 2026 the Council also ran a request-for-comments period on v4.0.1 to inform the next iteration, so it&#8217;s worth watching for future updates.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who Must Comply?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PCI DSS applies to any entity that stores, processes, or transmits cardholder data or sensitive authentication data, or that could affect the security of that environment. That includes merchants of every size, payment processors, acquirers, issuers, and service providers such as hosting companies or managed service providers with access to the cardholder data environment (CDE).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How compliance is validated depends on your merchant or service provider level, set by the card brands and your acquirer. Larger entities typically need a Report on Compliance (ROC) from a Qualified Security Assessor (QSA); smaller merchants often complete a Self-Assessment Questionnaire (SAQ).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The 12 PCI DSS Requirements<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The twelve principal requirements are grouped under six goals.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Goal<\/th><th>#<\/th><th>Requirement<\/th><\/tr><\/thead>\n<tbody>\n<tr><td>Build and maintain a secure network and systems<\/td><td>1<\/td><td>Install and maintain network security controls<\/td><\/tr>\n<tr><td>Build and maintain a secure network and systems<\/td><td>2<\/td><td>Apply secure configurations to all system components<\/td><\/tr>\n<tr><td>Protect account data<\/td><td>3<\/td><td>Protect stored account data<\/td><\/tr>\n<tr><td>Protect account data<\/td><td>4<\/td><td>Protect cardholder data with strong cryptography during transmission over open, public networks<\/td><\/tr>\n<tr><td>Maintain a vulnerability management program<\/td><td>5<\/td><td>Protect all systems and networks from malicious software<\/td><\/tr>\n<tr><td>Maintain a vulnerability management program<\/td><td>6<\/td><td>Develop and maintain secure systems and software<\/td><\/tr>\n<tr><td>Implement strong access control measures<\/td><td>7<\/td><td>Restrict access to system components and cardholder data by business need to know<\/td><\/tr>\n<tr><td>Implement strong access control measures<\/td><td>8<\/td><td>Identify users and authenticate access to system components<\/td><\/tr>\n<tr><td>Implement strong access control measures<\/td><td>9<\/td><td>Restrict physical access to cardholder data<\/td><\/tr>\n<tr><td>Regularly monitor and test networks<\/td><td>10<\/td><td>Log and monitor all access to system components and cardholder data<\/td><\/tr>\n<tr><td>Regularly monitor and test networks<\/td><td>11<\/td><td>Test security of systems and networks regularly<\/td><\/tr>\n<tr><td>Maintain an information security policy<\/td><td>12<\/td><td>Support information security with organizational policies and programs<\/td><\/tr>\n<\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What Changed in PCI DSS 4.0<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Version 4 introduced dozens of new or updated requirements compared with v3.2.1. The changes reflect four themes the Council set out to address.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Continuous Security, Not Annual Compliance<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Each requirement now includes explicit roles and responsibilities, and many controls require ongoing activity rather than a yearly check. Requirement 12.5.2, for example, requires entities to confirm and document their PCI DSS scope at least every 12 months and after significant changes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Flexibility Through the Customized Approach<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Organizations can now meet a requirement through either the <strong>defined approach<\/strong> (implementing the control as written) or the <strong>customized approach<\/strong> (designing a different control that meets the stated objective, supported by a targeted risk analysis and validated by the assessor). The customized approach suits mature organizations with strong risk management, but it requires more documentation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Targeted Risk Analysis<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Several requirements let entities set frequencies (for example, how often certain reviews occur) based on a documented targeted risk analysis under Requirement 12.3.1, rather than fixed intervals. This adds flexibility but also accountability.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Stronger Controls Against Modern Threats<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Version 4 tightened controls in areas where attacks have grown, including authentication, phishing, e-commerce skimming, and logging.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key New Requirements Explained<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">MFA for All Access Into the CDE (8.4.2)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Multi-factor authentication is now required for all non-console access into the cardholder data environment, not only for administrators or remote access. This affects internal users, third parties, and service accounts used interactively.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Stronger Passwords (8.3.6)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Where passwords are used, the minimum length increased to 12 characters (or 8 if the system doesn&#8217;t support 12), with numeric and alphabetic characters.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Payment Page Script Management (6.4.3)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Scripts loaded on payment pages must be authorized, have their integrity assured, and be inventoried with a written justification. This targets Magecart-style skimming attacks that inject malicious JavaScript into checkout pages.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Payment Page Tamper Detection (11.6.1)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A change- and tamper-detection mechanism must alert personnel to unauthorized modifications of HTTP headers and payment page content as received by the consumer&#8217;s browser. Together with 6.4.3, this is one of the most technically demanding changes for e-commerce merchants. Eligibility rules for some SAQ types were later adjusted, so merchants should check current PCI SSC guidance for their SAQ.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Anti-Phishing Mechanisms (5.4.1)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Processes and automated mechanisms must be in place to detect and protect personnel against phishing attacks. This is usually met with email security controls, complemented by <a href=\"https:\/\/securis360.com\/phishing-simulation.shtml\">phishing simulation<\/a> and security awareness training.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Automated Log Review (10.4.1.1)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Audit log reviews must be performed using automated mechanisms, such as a SIEM, rather than manual inspection alone.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Authenticated Internal Scanning (11.3.1.2)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Internal vulnerability scans must be performed using authenticated scanning, which gives deeper visibility into missing patches and misconfigurations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Vulnerability Management Beyond High and Critical (11.3.1.1)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Lower-severity vulnerabilities must also be addressed based on the entity&#8217;s targeted risk analysis, rather than ignored indefinitely.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption of Stored PAN (3.5.1.2)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Disk-level or partition-level encryption alone is no longer acceptable for protecting stored PAN on non-removable media; other methods such as tokenization, truncation, or file- or column-level encryption are required.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Security Awareness Updates (12.6.3.1)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Security awareness training must include threats such as phishing and social engineering. Securis360&#8217;s <a href=\"https:\/\/securis360.com\/employee-awareness-training.shtml\">employee awareness training<\/a> covers these topics.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Testing Requirements Under PCI DSS 4.0<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Requirement 11 remains one of the most practical areas to plan for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Internal and external vulnerability scans at least once every three months and after significant changes, with external scans performed by a PCI SSC Approved Scanning Vendor (ASV)<\/li>\n\n\n\n<li>Internal and external penetration testing at least once every 12 months and after significant changes<\/li>\n\n\n\n<li>Segmentation testing where segmentation is used to reduce scope (every 12 months for merchants and every six months for service providers)<\/li>\n\n\n\n<li>Intrusion detection or prevention to monitor traffic<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Our comparison of <a href=\"https:\/\/securis360.com\/blog\/internal-vs-external-penetration-testing\/\">internal vs external penetration testing<\/a> explains how each test contributes, and Securis360&#8217;s <a href=\"https:\/\/securis360.com\/vulnerability-assessment-and-penetration-testing-VAPT-solutions.shtml\">VAPT services<\/a> and <a href=\"https:\/\/securis360.com\/website-application-security-testing-services.shtml\">web application security testing<\/a> support these requirements.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to Approach PCI DSS 4.0 Compliance<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Confirm and minimize scope.<\/strong> Map every location where account data flows. Use tokenization, outsourced payment pages, and segmentation to shrink the CDE.<\/li>\n\n\n\n<li><strong>Perform a gap assessment<\/strong> against v4.0.1, paying particular attention to the formerly future-dated requirements.<\/li>\n\n\n\n<li><strong>Decide on defined vs customized approach<\/strong> for each requirement where flexibility might help.<\/li>\n\n\n\n<li><strong>Complete targeted risk analyses<\/strong> where the standard allows frequency to be risk-based.<\/li>\n\n\n\n<li><strong>Remediate technical gaps<\/strong>, often MFA coverage, script management, authenticated scanning, and automated logging.<\/li>\n\n\n\n<li><strong>Assign ownership<\/strong> for every requirement, as v4 expects documented roles and responsibilities.<\/li>\n\n\n\n<li><strong>Operate controls year-round<\/strong> and collect evidence continuously.<\/li>\n\n\n\n<li><strong>Validate<\/strong> through an SAQ or ROC as required by your acquirer or the card brands.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Common PCI DSS 4.0 Mistakes<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Assuming an outsourced payment provider removes all obligations.<\/strong> It reduces scope, but your website and processes can still affect payment security.<\/li>\n\n\n\n<li><strong>Underestimating script management.<\/strong> Many e-commerce sites load third-party scripts that nobody has inventoried.<\/li>\n\n\n\n<li><strong>MFA gaps for service accounts and vendors.<\/strong> Requirement 8.4.2 applies broadly.<\/li>\n\n\n\n<li><strong>Weak scoping.<\/strong> Undocumented data flows are a frequent source of assessment findings.<\/li>\n\n\n\n<li><strong>Treating compliance as security.<\/strong> PCI DSS is a baseline; breaches still occur at compliant organizations when controls lapse between assessments.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">PCI DSS overlaps with other frameworks such as ISO 27001 and SOC 2, so organizations pursuing several can coordinate efforts through a unified <a href=\"https:\/\/securis360.com\/compliance.shtml\">compliance program<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Is PCI DSS 4.0 mandatory?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">PCI DSS v4.0.1 is the only active version of the standard, and all requirements, including those that were future-dated, have been mandatory since 31 March 2025 for entities in scope.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is the difference between PCI DSS 4.0 and 4.0.1?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Version 4.0.1 is a limited revision that clarified wording, corrected errors, and updated guidance. It didn&#8217;t add or remove requirements.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What are the future-dated requirements in PCI DSS 4.0?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">They were new requirements considered best practice until 31 March 2025, after which they became mandatory. Examples include MFA for all CDE access, payment page script management, automated log review, and authenticated internal scanning.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does PCI DSS 4.0 require penetration testing?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Internal and external penetration testing is required at least every 12 months and after significant changes, along with segmentation testing where segmentation reduces scope.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is the customized approach in PCI DSS 4.0?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It allows an entity to meet a requirement&#8217;s objective with a control different from the one described, provided it performs a targeted risk analysis and the assessor validates that the control meets the objective.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>PCI DSS v4.0.1 is the only active version, and all v4 requirements are now mandatory.<\/li>\n\n\n\n<li>Version 4 emphasizes continuous security, flexibility, and stronger controls for authentication, phishing, and e-commerce skimming.<\/li>\n\n\n\n<li>MFA, script management, tamper detection, and automated logging are common gap areas.<\/li>\n\n\n\n<li>Minimizing scope and operating controls year-round make compliance more sustainable.<\/li>\n<\/ul>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"Is PCI DSS 4.0 mandatory?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"PCI DSS v4.0.1 is the only active version of the standard, and all requirements, including those that were future-dated, have been mandatory since 31 March 2025 for entities in scope.\"}},{\"@type\":\"Question\",\"name\":\"What is the difference between PCI DSS 4.0 and 4.0.1?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Version 4.0.1 is a limited revision that clarified wording, corrected errors, and updated guidance. It didn't add or remove requirements.\"}},{\"@type\":\"Question\",\"name\":\"What are the future-dated requirements in PCI DSS 4.0?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"They were new requirements considered best practice until 31 March 2025, after which they became mandatory. Examples include MFA for all CDE access, payment page script management, automated log review, and authenticated internal scanning.\"}},{\"@type\":\"Question\",\"name\":\"Does PCI DSS 4.0 require penetration testing?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. Internal and external penetration testing is required at least every 12 months and after significant changes, along with segmentation testing where segmentation reduces scope.\"}},{\"@type\":\"Question\",\"name\":\"What is the customized approach in PCI DSS 4.0?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"It allows an entity to meet a requirement's objective with a control different from the one described, provided it performs a targeted risk analysis and the assessor validates that the control meets the objective.\"}}]}<\/script>\n","protected":false},"excerpt":{"rendered":"<p>PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.<\/p>\n","protected":false},"author":1,"featured_media":1522,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[10],"tags":[1230,84,1232,1231,1229,150,1228,282],"class_list":["post-1470","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-cardholder-data","tag-compliance","tag-e-commerce-security","tag-mfa","tag-payment-security","tag-pci-dss","tag-pci-dss-4-0","tag-penetration-testing"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"shubhrasharma665@gmail.com\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"News &amp; Update of Cyber Security World Globally | Securis360 -\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)\" \/>\n\t\t<meta property=\"og:description\" content=\"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-19T03:30:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-15T04:54:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/securis360\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@securis360\" \/>\n\t\t<meta name=\"twitter:title\" content=\"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)\" \/>\n\t\t<meta name=\"twitter:description\" content=\"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@securis360\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#blogposting\",\"name\":\"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)\",\"headline\":\"PCI DSS 4.0 Requirements Explained: What Changed and What You Must Do\",\"author\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/author\\\/shubhrasharma665gmail-com\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/securis360.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/PCI-DSS-40-Compliance-Checklist.png\",\"width\":1672,\"height\":941,\"caption\":\"#image_title\"},\"datePublished\":\"2026-10-19T09:00:00+05:30\",\"dateModified\":\"2026-10-15T10:24:43+05:30\",\"inLanguage\":\"en-US\",\"commentCount\":1,\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#webpage\"},\"articleSection\":\"News, Cardholder Data, Compliance, E-commerce Security, MFA, Payment Security, PCI DSS, PCI DSS 4.0, Penetration Testing\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/securis360.com\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/category\\\/news\\\/#listItem\",\"name\":\"News\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/category\\\/news\\\/#listItem\",\"position\":2,\"name\":\"News\",\"item\":\"https:\\\/\\\/securis360.com\\\/blog\\\/category\\\/news\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#listItem\",\"name\":\"PCI DSS 4.0 Requirements Explained: What Changed and What You Must Do\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#listItem\",\"position\":3,\"name\":\"PCI DSS 4.0 Requirements Explained: What Changed and What You Must Do\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/category\\\/news\\\/#listItem\",\"name\":\"News\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/#organization\",\"name\":\"Securis360 Inc.\",\"description\":\"Securis360 is a global cybersecurity company providing Managed SOC, VAPT, SOC 2 Compliance, ISO 27001 Consulting, Cloud Security, SIEM, MDR, Incident Response and Cyber Risk Management services.\",\"url\":\"https:\\\/\\\/securis360.com\\\/blog\\\/\",\"telephone\":\"+16195593838\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/securis360.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/03\\\/cropped-final-logo-05.png\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#organizationLogo\",\"width\":512,\"height\":512,\"caption\":\"Securis360 Logo\"},\"image\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/securis360\",\"https:\\\/\\\/x.com\\\/securis360\",\"https:\\\/\\\/www.instagram.com\\\/securis360\",\"https:\\\/\\\/www.pinterest.com\\\/securis360\\\/\",\"https:\\\/\\\/www.youtube.com\\\/@Securis360\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/securis360\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/author\\\/shubhrasharma665gmail-com\\\/#author\",\"url\":\"https:\\\/\\\/securis360.com\\\/blog\\\/author\\\/shubhrasharma665gmail-com\\\/\",\"name\":\"shubhrasharma665@gmail.com\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#authorImage\",\"url\":\"https:\\\/\\\/securis360.com\\\/blog\\\/wp-content\\\/litespeed\\\/avatar\\\/d9cfd1db106e641415395713203d73df.jpg?ver=1792667799\",\"width\":96,\"height\":96,\"caption\":\"shubhrasharma665@gmail.com\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#webpage\",\"url\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/\",\"name\":\"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)\",\"description\":\"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/author\\\/shubhrasharma665gmail-com\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/author\\\/shubhrasharma665gmail-com\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/securis360.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/PCI-DSS-40-Compliance-Checklist.png\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#mainImage\",\"width\":1672,\"height\":941,\"caption\":\"#image_title\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/pci-dss-4-requirements-explained\\\/#mainImage\"},\"datePublished\":\"2026-10-19T09:00:00+05:30\",\"dateModified\":\"2026-10-15T10:24:43+05:30\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/securis360.com\\\/blog\\\/\",\"name\":\"News & Update of Cyber Security World Globally | Securis360\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/securis360.com\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)<\/title>\n\n","aioseo_head_json":{"title":"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)","description":"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.","canonical_url":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#blogposting","name":"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)","headline":"PCI DSS 4.0 Requirements Explained: What Changed and What You Must Do","author":{"@id":"https:\/\/securis360.com\/blog\/author\/shubhrasharma665gmail-com\/#author"},"publisher":{"@id":"https:\/\/securis360.com\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/securis360.com\/blog\/wp-content\/uploads\/2026\/10\/PCI-DSS-40-Compliance-Checklist.png","width":1672,"height":941,"caption":"#image_title"},"datePublished":"2026-10-19T09:00:00+05:30","dateModified":"2026-10-15T10:24:43+05:30","inLanguage":"en-US","commentCount":1,"mainEntityOfPage":{"@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#webpage"},"isPartOf":{"@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#webpage"},"articleSection":"News, Cardholder Data, Compliance, E-commerce Security, MFA, Payment Security, PCI DSS, PCI DSS 4.0, Penetration Testing"},{"@type":"BreadcrumbList","@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/securis360.com\/blog\/#listItem","position":1,"name":"Home","item":"https:\/\/securis360.com\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/securis360.com\/blog\/category\/news\/#listItem","name":"News"}},{"@type":"ListItem","@id":"https:\/\/securis360.com\/blog\/category\/news\/#listItem","position":2,"name":"News","item":"https:\/\/securis360.com\/blog\/category\/news\/","nextItem":{"@type":"ListItem","@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#listItem","name":"PCI DSS 4.0 Requirements Explained: What Changed and What You Must Do"},"previousItem":{"@type":"ListItem","@id":"https:\/\/securis360.com\/blog\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#listItem","position":3,"name":"PCI DSS 4.0 Requirements Explained: What Changed and What You Must Do","previousItem":{"@type":"ListItem","@id":"https:\/\/securis360.com\/blog\/category\/news\/#listItem","name":"News"}}]},{"@type":"Organization","@id":"https:\/\/securis360.com\/blog\/#organization","name":"Securis360 Inc.","description":"Securis360 is a global cybersecurity company providing Managed SOC, VAPT, SOC 2 Compliance, ISO 27001 Consulting, Cloud Security, SIEM, MDR, Incident Response and Cyber Risk Management services.","url":"https:\/\/securis360.com\/blog\/","telephone":"+16195593838","logo":{"@type":"ImageObject","url":"https:\/\/securis360.com\/blog\/wp-content\/uploads\/2026\/03\/cropped-final-logo-05.png","@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#organizationLogo","width":512,"height":512,"caption":"Securis360 Logo"},"image":{"@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#organizationLogo"},"sameAs":["https:\/\/www.facebook.com\/securis360","https:\/\/x.com\/securis360","https:\/\/www.instagram.com\/securis360","https:\/\/www.pinterest.com\/securis360\/","https:\/\/www.youtube.com\/@Securis360","https:\/\/www.linkedin.com\/company\/securis360"]},{"@type":"Person","@id":"https:\/\/securis360.com\/blog\/author\/shubhrasharma665gmail-com\/#author","url":"https:\/\/securis360.com\/blog\/author\/shubhrasharma665gmail-com\/","name":"shubhrasharma665@gmail.com","image":{"@type":"ImageObject","@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#authorImage","url":"https:\/\/securis360.com\/blog\/wp-content\/litespeed\/avatar\/d9cfd1db106e641415395713203d73df.jpg?ver=1792667799","width":96,"height":96,"caption":"shubhrasharma665@gmail.com"}},{"@type":"WebPage","@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#webpage","url":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/","name":"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)","description":"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/securis360.com\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#breadcrumblist"},"author":{"@id":"https:\/\/securis360.com\/blog\/author\/shubhrasharma665gmail-com\/#author"},"creator":{"@id":"https:\/\/securis360.com\/blog\/author\/shubhrasharma665gmail-com\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/securis360.com\/blog\/wp-content\/uploads\/2026\/10\/PCI-DSS-40-Compliance-Checklist.png","@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#mainImage","width":1672,"height":941,"caption":"#image_title"},"primaryImageOfPage":{"@id":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/#mainImage"},"datePublished":"2026-10-19T09:00:00+05:30","dateModified":"2026-10-15T10:24:43+05:30"},{"@type":"WebSite","@id":"https:\/\/securis360.com\/blog\/#website","url":"https:\/\/securis360.com\/blog\/","name":"News & Update of Cyber Security World Globally | Securis360","inLanguage":"en-US","publisher":{"@id":"https:\/\/securis360.com\/blog\/#organization"}}]},"og:locale":"en_US","og:site_name":"News &amp; Update of Cyber Security World Globally | Securis360 -","og:type":"article","og:title":"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)","og:description":"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.","og:url":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/","article:published_time":"2026-10-19T03:30:00+00:00","article:modified_time":"2026-10-15T04:54:43+00:00","article:publisher":"https:\/\/www.facebook.com\/securis360","twitter:card":"summary_large_image","twitter:site":"@securis360","twitter:title":"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)","twitter:description":"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.","twitter:creator":"@securis360"},"aioseo_meta_data":{"post_id":"1470","title":"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)","description":"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.","keywords":null,"keyphrases":{"focus":{"keyphrase":"PCI DSS 4.0 requirements","score":83},"additional":[{"keyphrase":"PCI DSS v4.0.1","score":78},{"keyphrase":"PCI DSS future-dated requirements","score":69},{"keyphrase":"PCI DSS 12 requirements","score":69},{"keyphrase":"PCI compliance","score":69}]},"focus_keyword":"PCI DSS 4.0 requirements","additional_keywords":[{"word":"PCI DSS v4.0.1","score":78,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":9},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"PCI DSS future-dated requirements","score":69,"items":{"introductionKeyword":{"score":6},"keyphraseLength":{"score":6},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"PCI DSS 12 requirements","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}},{"word":"PCI compliance","score":69,"items":{"introductionKeyword":{"score":3},"keyphraseLength":{"score":9},"keyphraseDensity":{"score":4},"functionWordsInKeyphrase":{"score":9},"textCompetingLinks":{"score":9},"imageKeyphrase":{"score":3}}}],"truseo_locale":null,"primary_term":null,"canonical_url":null,"og_title":"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)","og_description":"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.","og_object_type":"default","og_image_type":"default","og_image_custom_url":null,"og_image_custom_fields":null,"og_image_url":null,"og_image_width":null,"og_image_height":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_image_url":null,"twitter_title":"PCI DSS 4.0 Requirements Explained (v4.0.1 Guide)","twitter_description":"PCI DSS 4.0 requirements explained: the 12 core requirements, key v4 changes like MFA, script management and tamper detection, testing rules and compliance steps.","schema_type":"default","schema_type_options":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"breadcrumb_settings":null,"seo_analyzer_scan_date":"2026-10-19 03:44:50","created":"2026-10-07 14:30:30","updated":"2026-10-21 04:42:49","reviewed_by":"0"},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/securis360.com\/blog\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/securis360.com\/blog\/category\/news\/\" title=\"News\">News<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tPCI DSS 4.0 Requirements Explained: What Changed and What You Must Do\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/securis360.com\/blog\/"},{"label":"News","link":"https:\/\/securis360.com\/blog\/category\/news\/"},{"label":"PCI DSS 4.0 Requirements Explained: What Changed and What You Must Do","link":"https:\/\/securis360.com\/blog\/pci-dss-4-requirements-explained\/"}],"_links":{"self":[{"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/posts\/1470","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/comments?post=1470"}],"version-history":[{"count":1,"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/posts\/1470\/revisions"}],"predecessor-version":[{"id":1544,"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/posts\/1470\/revisions\/1544"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/media\/1522"}],"wp:attachment":[{"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/media?parent=1470"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/categories?post=1470"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securis360.com\/blog\/wp-json\/wp\/v2\/tags?post=1470"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}