Version 4.0.1 has been the only active PCI DSS standard since 3.2.1 retired on March 31, 2024, per the PCI Security Standards Council. Its 51 future-dated requirements became mandatory March 31, 2025, and merchants now attest against them, from script integrity to expanded MFA.
Nuv Media publishes information, not financial advice.
What Changed When the Future-Dated Requirements Activated?
Assessment consequences. The PCI Security Standards Council published version 4.0 on March 31, 2022 with a three-year transition, during which 51 requirements were labeled best practices only. After March 31, 2025, assessors test those same requirements as mandatory, and an attestation that skips them is deficient on its face.
Version 4.0.1, released in June 2024, clarified wording and guidance without adding requirements or moving deadlines, per the Council's publication. That means the March 31, 2025 activation date survived the minor revision, and version 3.2.1 assessments have been invalid since it retired on March 31, 2024.
The standard also widened how compliance can be demonstrated. Merchants can meet a requirement through the defined approach, the prescriptive testing the document spells out, or the customized approach, where the merchant designs a control that meets the requirement's stated objective and documents how, subject to assessor validation and targeted risk analyses.
What Do Requirements 6.4.3 and 11.6.1 Demand on Payment Pages?
Script control and tamper detection. Requirement 6.4.3, effective March 31, 2025, applies to every entity with a payment page: each script executing on that page must be authorized, justified and covered by a mechanism assuring its integrity. Requirement 11.6.1 adds a change- and tamper-detection mechanism that alerts personnel when payment pages are modified without authorization.
The pair targets payment-card skimming, in which an injected snippet quietly harvests cardholder data as customers type it. A payment page can carry dozens of third-party tags for analytics, chat and fraud scoring, and the requirement forces that sprawl into an inventory with owners and integrity checks, rather than a free-for-all marketers append to at will.
For merchants whose payment pages are fully hosted by a validated third party, the obligation shifts to confirmation: the PCI SSC's guidance directs such merchants to verify their provider maintains these controls, since the merchant still signs the attestation.
How Far Does the Expanded MFA Reach?
Every account that can touch cardholder data. The version 4.0 expansion of Requirement 8, through requirements 8.4.2 and 8.4.3 that activated March 31, 2025, extends multi-factor authentication beyond administrators and remote access to all user accounts with access into the cardholder data environment, including accounts used by third parties and for application and system processes where applicable.
Practically, that means the consultant with a VPN account, the database service account reachable from the CDE and the executive with a legacy login all need a second factor before touching systems in scope. Merchants who segmented their CDE tightly face fewer accounts to convert, which is one reason segmentation review pays for itself in version 4.0.1 assessments.
Which SAQ Applies to Your Merchant Profile?
Scope decides the form. The Self-Assessment Questionnaire paths changed little in structure between versions, but the requirements packed into each one did. The common merchant paths:
| SAQ | Profile | Notable v4.x additions |
|---|---|---|
| A | Fully outsourced card handling, e-commerce or telephone | Confirm provider script-integrity and tamper-detection controls |
| A-EP | E-commerce where the merchant's website affects the transaction | Direct 6.4.3 and 11.6.1 implementation on payment pages |
| D-Merchant | Large merchants and any profile outside other SAQs | Full 51-requirement future-dated set in scope |
| D-SP | Service providers | Full standard plus service-provider-specific obligations |
An SAQ A merchant remains the narrowest category: no electronic storage, processing or transmission of cardholder data on its own systems, with acceptance handled entirely by PCI-validated providers. Incomplete outsourced arrangements, such as a hosted payment iframe modified by the merchant's own scripts, push the profile toward A-EP and its heavier obligations.
What Does an Annual Cycle Look Like Under 4.0.1?
The recurring machinery is unchanged in shape but stricter in testing. Quarterly external vulnerability scans by an approved scanning vendor continue under Requirement 11.2.2, penetration testing under 11.4 follows the six-tier methodology the standard now defines, and network security controls replaced the older firewall-specific language across Requirement 1.
New evidence types matter now. Customized-approach controls need documented objective mapping and assessor validation, targeted risk analyses need written records where the standard permits frequency flexibility, and the expanded MFA population needs an inventory proving coverage. Merchants who treat 4.0.1 as 3.2.1 with new section numbers are the ones finding deficiencies at attestation time.
Calendar discipline also decides pass or fail. Assessments carry an attestation date, not a validity period, so merchants who run discovery in autumn and testing the following spring often present stale evidence. Teams that timestamp script inventories, alert tests and MFA reviews quarterly close most of that gap without new tooling.
What Should Merchants Audit First This Year?
The payment page, then the account list. These produce the most failed tests since March 2025, and both are checkable in an afternoon of discovery:
- Inventory every script on each payment page and assign an owner, an authorization record and an integrity mechanism per 6.4.3.
- Deploy and test tamper-detection alerts on payment pages per 11.6.1, including a scheduled alert test.
- List every account with CDE access and verify MFA coverage against requirements 8.4.2 and 8.4.3.
- Re-confirm SAQ eligibility, since scope creep, a new checkout tag or a changed hosting arrangement can move categories.
- Refresh targeted risk analyses and document any customized-approach mappings before the assessor asks.
None of this prevents a breach by itself, but each item is now testable, dated and signed, which is precisely what the Council traded away three years of transition time to obtain.
For more context, read How a Card Chargeback Moves From Dispute to Final Decision.
For more context, read visa mastercard stablecoin platform.
For more context, read instant account verification.
