Transitioning to PCI DSS v4.0 is a critical step for organizations aiming to secure payment data against evolving threats. This chapter offers a roadmap for navigating the shift, focusing on key deadlines, strategic planning, and leveraging available resources for a smooth transition.
These are the 8 most notable new requirements when comparing PCI DSS v4 to v3.2.1 (all future-dated and effective from the 31st March 2025).
- Bi-annual review of all user accounts and related access privileges
- More stringent password requirements (length increasing from 7 to 12 characters, no hard-coding in files or scripts)
- Multi-factor authentication required for all access to Card Data Environment (CDE) vs administrative access to CDE previously
- Revamp of multi-factor authentication requirements for secure implementation
- Daily log reviews by use of automated mechanisms vs the option of manual reviews previously
- Authenticated scanning for internal vulnerability scans
- Address covert malware communication channels by use of intrusion detection/prevention techniques
- Regular PCI DSS scope confirmation including card data discovery techniques
