PCI-DSS 4.0: What’s changing and how to prepare

Vanta offers a pre-built PCI-DSS 4.0 framework to accelerate and automate PCI compliance. The framework includes pre-built controls, policies, automated tests, and other content, all of which can optionally be customized to meet specific needs.

‍

As the way we do business continues to evolve, so do the requirements to remain compliant. PCI-DSS is no exception, and as of March 31, 2024, PCI-DSS 4.0 will introduce some significant changes. These differences are mostly iterative but could be very impactful for organizations depending on how they previously approached PCI-DSS 3.2.1. 

‍

PCI-DSS 4.0 takes some significant strides in favor of uplifting its basic expectations for organizations and adapting to new technologies, rather than simply updating its terminology. This can introduce some jarring changes in expectations and requirements for organizations that previously aimed for baseline, as opposed to ideal requirements.

‍

These changes can possibly sneak up on companies if they aren't thoughtful and deliberate about their transition before the March 31, 2024 deadline. Vanta strongly recommends customers work with a Vanta partner to navigate all the nuances well ahead of the transition deadline. Vanta can help streamline and automate much of the process, but how it works for each individual company will vary, requiring some amount of hands-on work to unpack as PCI-DSS is far less one-size-fits-all than SOC 2 or ISO 27001.

‍

‍

Key changes in PCI-DSS 4.0

In light of some of these tough to navigate changes, our partner Online Business Systems has an absolutely fantastic series of write-ups and evaluations of the transition for companies who want to dig deep into how PCI-DSS works and what it means for their business.

‍
A short, but not comprehensive, list of example changes for customers to be aware of is as follows and more high level info can be found here:

‍

• Log reviews of critical systems must be automated as opposed to manual review being an option (PCI-DSS 10.4.1.1)
• Password strength default increased to 12 characters (PCI-DSS 8.3.6)
• Password rotation every 90 days only applies if username and password is the only authentication mechanism (i.e. no MFA or similar) (PCI-DSS 8.3.9)
• Authenticated vulnerability scanning is specifically required for internal vulnerability scans (PCI-DSS 11.3.1.2)
• All Critical and High severity vulnerabilities detected need to be corrected within 30 days and every detected vulnerability must be remediated in line with documented company criteria (11.3.1.1)
• The introduction of the Customized Approach - Companies can define their own custom controls to meet PCI-DSS 4.0 requirements so long as they perform a documented risk assessment on each control and specifically and explicitly document the ways their implementation satisfies the intent of the requirement on an annual basis.
• Annex A1 becomes more broadly important for many SaaS (Multi-Tenant) Service Providers depending on how they operate.

‍

If you’re interested in reading more about the changes to the official requirements check out our PCI-DSS 4.0 changelog article in our Help Center.

‍

‍

Final thoughts

There is a lot more to dive into with PCI 4.0, and some important administrative differences that may come up for some organizations. If you’re ready to transition to PCI-DSS 4.0 or interested in pursuing this framework, contact us today to learn more.

‍