PCI DSS v4.0.1: what changed and when it applied
PCI DSS v4.0.1 is the only active version of the standard. It was published on 11 June 2024 as a limited revision of v4.0, adding and removing no requirements. Since 31 March 2025, all 51 requirements that v4.0 marked as "future-dated" are mandatory in every assessment. 1 Sequence Cyber Ltd, a PCI SSC-listed QSA company, assesses merchants and service providers against v4.0.1.Last reviewed: 11 November 2026
Key dates
| Date | What happened |
|---|---|
| 31 March 2022 | PCI DSS v4.0 published, with 51 future-dated requirements |
| 31 March 2024 | v3.2.1 retired; all assessments move to v4.x |
| 11 June 2024 | v4.0.1 published: clarifications only, no requirements added or removed |
| 31 December 2024 | v4.0 retired; v4.0.1 is the only active version |
| 30 January 2025 | Updated SAQ A published (see below) |
| 31 March 2025 | The 51 future-dated requirements become mandatory; the new SAQ A takes effect |
| June to July 2026 | PCI SSC request for comments on v4.0.1, to shape the next version |
The requirements that changed most
- Passwords of at least 12 characters (8.3.6).
- Multi-factor authentication for all access into the cardholder data environment (8.4.2).
- Automated review of audit logs (10.4.1.1).
- Control of scripts on payment pages (6.4.3), and change and tamper detection for those pages (11.6.1).
- Disk-level encryption alone no longer protects stored card numbers on non-removable media (3.5.1.2).
- Targeted risk analyses to set the frequency of many periodic tasks (12.3.1).
- Phishing protection (5.4.1) and security awareness that covers phishing (12.6.3.1).
- An incident response procedure for card numbers found where they are not expected (12.10.7).
Payment page security: 6.4.3 and 11.6.1 · Incident response: Requirement 12.10
The January 2025 SAQ A change
On 30 January 2025 PCI SSC published a new SAQ A, effective 31 March 2025. It removed Requirements 6.4.3, 11.6.1 and 12.3.1 from SAQ A and added an eligibility criterion: the merchant must confirm its site is not susceptible to attacks from scripts that could affect its e-commerce systems. The requirements themselves remain in PCI DSS and still apply to SAQ A-EP, SAQ D and service providers.
Frequently asked questions
When was PCI DSS 4.0 required?
Assessments moved to v4.x when v3.2.1 retired on 31 March 2024. The future-dated v4 requirements became mandatory on 31 March 2025.
Did v4.0.1 add new requirements?
No. It clarified wording and guidance; no requirements were added or deleted.
What does v4.0.1 say about encryption?
Stored card numbers must be unreadable (3.5.1). Disk-level encryption is only enough on its own for removable media (3.5.1.2); elsewhere, card numbers need another method, such as strong cryptography at the file, column or field level, hashing, truncation or tokenisation.