PCI DSS v4.0.1: Requirements & Priorities for 2026

PCI DSS v4.0.1 is the only active version of the payment card data security standard. Since March 31, 2025, the 51 previously future-dated requirements have become mandatory during assessments. Furthermore, in 2026, the PCI SSC launched the consultation process to prepare the next standard version.

What Is PCI DSS?

PCI DSS is published by the PCI Security Standards Council (PCI SSC), founded in 2006 by American Express, Discover, JCB, Mastercard, and Visa. It applies to any entity that stores, processes, or transmits cardholder data, or that can impact the security of the environment in which it flows: merchants, processors, acquirers, issuers, and service providers (Bright Defense).

It is not a law. Enforcement operates through payment card brand rules, acquiring banks, and merchant agreements. The PCI SSC does not publish a single schedule of fines: the consequences of non-compliance range from higher processing fees and post-incident forensic investigations to losing the ability to accept card payments (Bright Defense).

The Timeline

Date	Milestone
March 31, 2022	Publication of PCI DSS v4.0
March 31, 2024	Retirement of v3.2.1
June 11, 2024	Publication of v4.0.1: corrections and clarifications, with no requirements added or removed
December 31, 2024	Retirement of v4.0: v4.0.1 becomes the only active version
January 30, 2025	Revision of Self-Assessment Questionnaire SAQ A
March 31, 2025	The 51 "future-dated" requirements become mandatory
June 3 – July 20, 2026	Public Request for Comments (RFC) on v4.0.1 to prepare the next version

Sources: Bright Defense, PCI SSC.

The 12 Requirements

1. Install and maintain network security controls.
2. Apply secure configurations to all system components.
3. Protect stored account data.
4. Encrypt cardholder data during transmission over open, public networks.
5. Protect systems and networks against malicious software.
6. Develop and maintain secure systems and software.
7. Restrict access to cardholder data by business need to know.
8. Identify users and authenticate access.
9. Restrict physical access to cardholder data.
10. Log and monitor all access.
11. Regularly test the security of systems and networks.
12. Support information security with organizational policies and programs.

What Version 4 Really Changed

Version 4.0 introduced 64 new requirements, 51 of which only became mandatory on March 31, 2025. The most impactful include (Bright Defense):

• Requirement 6.4.3: Inventory, authorize, and justify each script executed on payment pages.
• Requirement 11.6.1: Detect unauthorized changes to payment pages and HTTP security headers. These two measures target e-skimming—the theft of cardholder data via malicious scripts executed in the customer's browser.
• Enhanced authentication, featuring an expansion of multi-factor authentication (MFA).
• Targeted risk analyses, allowing organizations to establish customized cadences for specific controls.
• Customized approach: the ability to demonstrate that an alternative control fulfills the requirement's security objective, provided it is fully documented.
• Service provider oversight for third parties impacting the payment environment.

For small e-commerce merchants who fully outsource payment processing, the PCI SSC removed requirements 6.4.3, 11.6.1, and 12.3.1 from the SAQ A self-assessment questionnaire, in exchange for a new eligibility criterion regarding scripts. The requirements themselves remain unchanged (Bright Defense).

Validating Compliance: SAQ or ROC

Depending on your transaction volume, risk profile, and the requirements of your acquirer or card brands, you validate compliance either:

• through a Self-Assessment Questionnaire (SAQ), with the template determined by how you accept payments;
• through a Report on Compliance (ROC) produced by a Qualified Security Assessor (QSA).

In both cases, an Attestation of Compliance (AOC) is issued. Your acquiring bank determines the required validation method.

What’s Ahead: Preparing for the Next Version

From June 3 to July 20, 2026, the PCI SSC invited stakeholders to submit feedback on v4.0.1 to initiate the next standard revision. The Council explicitly requested input on how the standard should evolve alongside emerging technologies and AI-driven innovations (PCI SSC).

This consultation represents neither a postponement nor an enforcement grace period: v4.0.1 remains the active benchmark for all current assessments (Bright Defense).

Where to Start

1. Accurately define your Cardholder Data Environment (CDE): where cardholder data is stored, processed, or transmitted, and which connected systems can impact its security.
2. Inventory all scripts on your payment pages and implement change detection mechanisms.
3. Verify multi-factor authentication coverage across all access paths to the CDE.
4. Formalize the division of responsibilities with every payment, hosting, and managed service provider.
5. Collect audit evidence continuously rather than rushing immediately prior to the assessment: scans, penetration tests, access reviews, and logs.
6. Confirm the required validation track (SAQ or ROC) with your acquiring bank.

How Domyno Supports You

PCI DSS v4 demands continuous compliance rather than a last-minute sprint before the audit. Domyno was built specifically for this: an incredible platform that adapts to your payment model, from small online merchants to large service providers. With our custom framework, you can combine the 12 PCI DSS requirements, your acquirer's mandates, and internal policies into a unified, tailored repository.

The control plan is your strongest asset for v4: vulnerability scans, penetration tests, access reviews, and targeted risk analyses are scheduled, assigned, and documented throughout the year. Asset management helps you clearly map your cardholder data environment, while vulnerability management, incident tracking, and third-party risk management complete the picture.

As an option, our cyber awareness solution helps you operate the security awareness program required by the standard. Domyno's AI and a dedicated compliance expert guide you through the process until full validation, whether via SAQ or ROC.

Sources

• PCI SSC — Request for Comments: PCI Data Security Standard (PCI DSS) v4.0.1 (June 3, 2026)
• Bright Defense — PCI DSS v4.0.1 Sets New Baseline For Cardholder Data Security (Updated September 21, 2026)