PCI DSS v4 – Changes at a Glance

|
|
PUBLISHED on
13
June
2022

After several years wait, and to surprisingly little fanfare, the Payment Card Industry Security Standards Council (PCI SSC) released the new version of the PCI Data Security Standard (DSS) on 31 March 2022.  It has been 4 years since the last minor update (v3.2.1) and nearly 9 years since the last major update (v3.0).  Given the ever evolving risks and changes in the security landscape and technologies, it can be argued that the new release is long overdue.  The question is, what has changed and why is this classified as a major update?  So, here’s a brief summary of the key changes.

The Requirements

There have been a lot of minor clarifications, renumbering, and rearranging of the requirements within the Standard to make it flow better and easier to follow.  But there are also approximately 40 new requirements across a variety of areas including:

  • Increased requirements for multi-factor authentication across the scope
  • New requirements mandating the deployment of anti-phishing systems
  • Greatly expanded risk assessment requirements
  • Mandatory deployment of a web application firewall (WAF) for public-facing web applications
  • Change detection on HTTP headers of payment pages.

Customised Validations

This, in URM’s opinion, is what makes this update a major change.  The Council has introduced a completely new way for organisations to validate their PCI compliance status, calling it a ‘customised validation’.  Simply put, this is a new way to meet the intent of any given requirement, but with a control that you design and implement.

This provides your organisation with the flexibility to meet a requirement in a way that best suits you, however, it is not without its drawbacks.  A customised validation requires a great deal of effort from your organisation to design, document, detail, test, and maintain controls, much of which relies on you having a mature risk assessment process embedded within your operations and processes.

In short, customised validations are not for the faint hearted and require a significant resource investment to accomplish correctly, not to mention the increased level of effort required by your QSA to assess each customised validation as being compliant.

Additional Resources

On 7 April 2022, URM held a webinar that outlined some of the key changes within version 4 of the Standard and the implications of those changes. If you would like to access a recording of this webinar, please complete the form below and we will email you a link at the earliest opportunity, i.e. during normal office hours – Monday to Friday, 9 to 5:30.

Are you looking for a PCI QSA?

As a long-established PCI QSA, URM is able to deliver a full PCI QSA-led audit and produce a report on compliance (RoC) as well as deliver a full QSA-led self-assessment questionnaire (SAQ)
Thumbnail of the Blog Illustration
Information Security
Published on
21/11/2023
How to Meet Key New PCI DSS 4.0 Requirements

Meeting the new payment page requirements in PCI DSS v4.0 may seem tricky. URM provides detailed guidance on implementation and effective payment page security.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
21/2/2025
The Impact of AI on PCI DSS Compliance

URM’s blog explores how AI can impact PCI DSS compliance, both in terms of the benefits it can provide and the challenges it may present.

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
9/8/2022
PCI DSS: Pros and Cons of Outsourcing

In this blog, we address one of the big questions facing organisations which accept payment cards....

Read more
Our URM consultant was really thorough, genuinely helpful and contributed real value literally within the first few minutes of our session by pointing out some (not-so-obvious) details of the new version of ISO 27001 that we hadn't been aware of until then. He then proceeded with a very well-prepared run-through and explanation of the controls in scope for our upcoming internal audit. Definitely a highlight and overall, very positive experience for us!
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.