Confessions of a QSA: PCI DSS Version 4.0

In March of 2022, the Security Standard’s Council released version 4.0 of its Payment Card Industry Data Security Standard (PCI DSS.) Weaver’s IT Advisory Services’ Kyle Morris, Senior Manager, and Brittany George, Partner, spoke to Tyler Kern about the new standard and what people need to know on this episode of the show.

PCI DSS 4.0 applies to entities storing, processing, and transmitting cardholder data or could affect the security of cardholder data. Kyle said this includes merchants who sell goods and services and get paid with a credit or debit card, like a Visa or Mastercard as well as service providers and other entities that support these merchants. “So, that can affect many different types of organizations.”

Version 4.0 came out this past March, but the new standards do not take effect until March 31, 2024. This will give merchants and service providers time to prepare for the latest compliance standard. There is also a transitional period, said Kyle. “Entities will have another year on top of 2024, to March 31, 2025, to implement some of the new requirements going into place.”

“You can opt-in early for version 4.0,” Brittany said. “It is fine for organizations that are ready to do that. It is actually considered a best practice.”

What are some of the changes in the latest version? “One key difference is the approach to implementing PCI,” Brittany said. “We currently have the defined approach, the traditional method of implementing the requirements as stated. Version 4.0 will introduce the customized approach, which is an alternative way of implementing the requirements.”

This customized approach offers the ability to implement the controls in an advanced way, for example through machine learning. “Organizations, including many or our clients, have been asking for this for years, especially those who have been on the leading edge of technology,” Kyle said.