PCI DSS v4: card data security in the digital payments era

1Introduction

PCI DSS, maintained by the PCI Security Standards Council, protects cardholder data across the payment chain.

2Discussion

Version 4.0 was published in March 2022; v3.2.1 was retired in March 2024 and future-dated requirements became mandatory in March 2025.

Twelve requirements across six goals remain, with expanded MFA, stronger passwords, payment-page script monitoring and targeted risk analysis.

A customised validation approach lets firms meet control objectives with alternative, documented controls.

3Conclusion

Reducing scope through tokenisation and hosted payment pages is the most effective way to lower compliance burden.