PCI DSS v4.0: Exploring What's New in the Latest Version

‍PCI DSS v4.0 brings changes that focus on risk management and securing third-party systems to address the growing threats. But how can you keep up with these changes and comply with the new version? This article explains the key changes in PCI DSS v4.0, helping you understand and stay compliant.

It might become difficult for your organization to comply with PCI DSS v4.0. But why? The new version requires organizations to make changes for better data security. Unawareness or a lack of understanding of these changes might cause non-compliance, making your organization vulnerable to compliance gaps, data leakage, and penalties.

In this blog, we will give you an overview of PCI DSS v4.0, followed by mentioning the key changes, reasons for these changes, and steps to efficiently comply with the new version. Let's dive into these in detail.

An Overview of PCI DSS v4.0

The compliance standard, Payment Card Industry Data Security Standard (PCI DSS), is the payment industry's definitive security standard. PCI DSS v4.0 is the latest version of this standard. The new version of PCI DSS introduces a few updates to enhance data security in the payment card industry. This update will also ensure that your organization can better protect cardholder data in the changing threat environment.

Let's understand the key focus of the new version of PCI DSS includes:

• A more flexible and risk-based approach to compliance
• Enhanced authentication and security control standards
• Increased focus on cloud security

When Does PCI DSS v4.0 Go Into Effect?

PCI DSS v4.0 is already available for your organization to review and implement. However, the transition period from v3.2.1 to v4.0 is ongoing. The current version, PCI DSS v3.2.1, remained valid until March 31, 2024. After this date, PCI DSS v4.0 has fully replaced the older version.

If your organization handles payment card data, it must comply with v4.0 by March 31, 2025. This additional year offers your organization time to adopt the new standards. It allows your organization to implement changes, test systems, and ensure compliance.

As an IT manager, you should act accordingly to prepare for the transition.

• Start by identifying gaps in your current compliance efforts.
• Review v4.0’s changes, like multi-factor authentication and risk-based approaches.
• Work with your team to prioritize updates and ensure everyone understands the timeline.
• You also need to communicate with third-party vendors. Ensure they are aligned with v4.0 requirements.
• Regular assessments and clear timelines will help avoid last-minute issues.

Key Changes in PCI DSS v4.0

Here are the key changes in the new version of PCI DSS.

1. Adding a customized approach for implementing and validating PCI DSS

PCI DSS v4.0 introduces a new customized approach for meeting security goals. Organizations can now design their own controls to meet specific requirements. This allows more flexibility compared to the traditional “defined” approach.

Your organization can tailor solutions based on their risks, size, and operational needs. However, they must prove the effectiveness of these customized controls during assessments.

2. Updated more specific requirements

The new version updates many existing specific requirements to align with the current threats. Multi-factor authentication (MFA) is now mandatory for all users accessing cardholder data environments.

Additionally, encryption requirements have been clarified. This ensures stronger data protection both during transmission and storage. The updates also encourage continuous monitoring to maintain compliance year-round.

3. New requirements

The new version of PCI DSS introduces 64 new requirements. Some are recommended for now and become mandatory by March 2025. These requirements include stricter password policies, more detailed documentation, and improved network security measures.

Moreover, the new rules are created to address emerging third-party threats caused by vulnerabilities in third-party systems. The new version of PCI DSS emphasizes third-party security, including third-party service providers and supply-chain security, which helps protect against cyberattacks.

4. Enhanced PCI DSS assessment reports

PCI DSS v4.0 includes changes to the attestation of compliance (AoC) and the report of compliance (RoC). The new version focuses on providing more detailed information to auditors and assessors.

This additional information includes detailed risk analyses, clear explanations of customized controls, and evidence of continuous compliance. The goal is to ensure transparency and help organizations identify areas needing improvement.

The changes mentioned above will give your organization better ways to protect your sensitive payment data.

4 Reasons For The Changes in PCI DSS v4.0

Let’s discuss the key reasons for the changes made in PCI DSS v4.

1. Meeting the evolving security requirements

Due to constant changes in the payment industry, updating compliance standards to meet these changes is important. PCI DSS v4.0 has been updated to address these modern security challenges. The goal is to protect sensitive payment data against current and future risks.

2. Promoting security as an ongoing process

Security requires continuous monitoring and improvement. PCI DSS v4.0 emphasizes making security practices part of daily operations. This helps organizations stay prepared and reduces the risk of breaches.

3. Enhancing validation methods and procedures

Validating compliance can be complex and time-consuming. The new version of PCI DSS introduces better ways to verify security controls are in place. These enhancements make the process clearer and more efficient for your team.

4. Adding flexibility to achieve security goals

Imagine your organization uses different tools and methods to secure its systems. PCI DSS v4.0 will allow more flexibility in meeting security requirements. This will help your organization adopt solutions that align with your unique needs while maintaining strong protection.

How to Comply with PCI DSS v4.0

‍

Let's discuss the 6 simple steps to comply with the new version of PCI DSS.

Step 1: Understand the New Requirements in Detail

You can start by reviewing the details of the new PCI DSS version's updates. After that, you need to pay attention to the new requirements and changes that can impact your organization, such as enhanced encryption standards or stricter access controls. This will help you identify what has changed in your existing system and needs adjustments.

Step 2: Perform a Gap Analysis and Update Your Security Policies & Procedures Accordingly

After properly understanding the new PCI DSS requirements, you need to conduct a gap analysis. This analysis will help you compare your current security practices with the updated standards. For example, if the new version mandates more robust logging practices, check if your systems meet this need.

Once gaps are identified, it's time to update your organization's security policies and procedures accordingly. For instance, if the updated standards require all your users to use multi-factor authentication (MFA), ensure this requirement is clearly outlined in your organization's policy.

Step 3: Use Suitable Continuous Monitoring Tools

Compliance is an ongoing effort, so you can use monitoring tools to continuously check your systems. This will help you track and manage vulnerabilities, unauthorized access, or unusual activity. For example, use a tool that helps you monitor unexpected changes to payment data in your organization in real-time.

Step 4: Work with a Qualified Assessor

This step allows you to engage with a Qualified Security Assessor (QSA), who will help your organization comply with the required regulations. They help to guide you through the validation process and ensure your organization's systems meet the PCI DSS standards. For example, consider a QSA audit of your encryption methods or evaluate your network security measures. Auditing this will help you understand whether your organization's security measures align with the PCI DSS requirements.

Step 5: Document Everything

Keeping a detailed record of all your organization's compliance activities is an important step towards complying with PCI DSS. Recording details include policies, risk assessments, and remediation efforts taken within your organization. Proper documentation will help you during audits and maintain compliance with PCI DSS.

Step 6: Leverage Flexibility Options

PCI DSS's new version offers more flexibility in meeting the PCI DSS requirements. If a specific control doesn't suit your setup, explore alternative methods. For example, if encrypting certain data isn't practical, consider using tokenization. Thus, work with your QSA to validate these alternatives and ensure they meet compliance standards.

Also Read: If you want to comply with the standard, consider reading the PCI DSS Compliance Checklist.

How Have The Risk Assessments Requirements Changed in PCI DSS v4.0?

In PCI DSS v3.2.1, risk assessment was a recommended practice for your organization to conduct periodic assessments of the security posture of your systems and processes. This helped you to identify and address risks to your organization’s cardholder data.

However, the guidelines were not prescriptive about how often assessments should occur or what they should include. This left a loophole for varying interpretations, leading to inconsistent practices across your organization.

Considering the gaps, PCI DSS v4.0 has introduced clearer and more detailed requirements for risk assessments. Now, your organization must conduct risk assessments regularly. The frequency should align with your organization’s specific risk profile and operational needs. This ensures that your organization will remain vigilant against the evolving threats.

Below mentioned are a few requirements for conducting risk assessments as per the new version:

• Risk assessments must now consider a wider range of risks, including human errors, physical security gaps, and environmental threats. This goes beyond the previous version, which primarily focuses on technical vulnerabilities.
• Recording your organization’s risk assessments, findings, and actions in detail is necessary for this process to be effective. These records are important for validation during audits and for ensuring ongoing compliance.
• In the new version, risk assessments must work alongside continuous monitoring. This means your organization’s real-time monitoring tools should provide up-to-date insights into potential vulnerabilities, helping you address risks effectively.

Stay Compliant with PCI DSS v4.0

To stay compliant with PCI DSS v4.0, you need to implement proper access control measures in your organization. This will help you meet the new changes in PCI DSS, like third-party security.

But how do you ensure that you have implemented all the necessary controls? To assess this, you need to perform regular access reviews. However, manually doing this can be time-consuming and might lead to errors and gaps.

Thus, automation is the only solution to save your time and resources. Many tools are available to automate the access review process. One such tool is Zluri’s access review solution. It will help your team provide insights on who has access to what.

Then, Zluri allows you to auto-remediate unauthorized access permissions, ensuring only the right people have access to your organization’s sensitive systems. Once you are done reviewing users' access, Zluri allows you to generate access review reports, which act as proof of evidence for the auditors during the audit process. If the report shows that your organization has complied with all the required rules of PCI DSS v4.0, then the auditor will certify you for the PCI DSS compliance standard.

Thus, using solutions like Zluri will help you easily ensure that your organization stays secure and meets the new PCI DSS standards.

Let’s take Intune as an example to see how you can automate user access review in Zluri.