PCI DSS v4.0.1: What’s Changing in 2025 and How Businesses Should Prepare

PCI DSS v4.0.1 comes into effect in 2025. Learn what’s changing, the key compliance deadlines, and how your business can prepare with expert guidance from Silver Lining Convergence.

Earlier this week, we explored what PCI compliance means and why it’s crucial for protecting customer payment data. This time, we’re looking ahead to the next important update, PCI DSS v4.0.1, which will become the primary standard in 2025.

Although this version isn’t introducing new requirements, it still matters. The changes focus on clarity, accuracy, and interpretation, helping businesses apply the standard consistently and avoid confusion during audits or assessments.

If your organisation processes, stores, or transmits payment card data, it’s vital to understand what PCI DSS v4.0.1 means for you, and how to prepare now.

What is PCI DSS v4.0.1?

The Payment Card Industry Data Security Standard (PCI DSS) was developed by the PCI Security Standards Council (PCI SSC) to safeguard cardholder data worldwide. It outlines a set of technical and operational requirements designed to reduce payment card fraud and data breaches.

Version 4.0.1, released in June 2024, is an update to PCI DSS v4.0, which itself was the most significant revision in over a decade. However, unlike v4.0, this latest update doesn’t add or remove any controls. Instead, it’s what the Council calls a “limited revision” designed to correct errors, improve clarity, and strengthen guidance for both assessors and businesses.

From 1 January 2025, all new PCI assessments will use v4.0.1. The previous version (v4.0) will be retired after 31 December 2024, meaning businesses must transition before the end of the year.

The future-dated requirements first introduced in v4.0 also become mandatory from 31 March 2025, giving organisations a clear window to review and align their systems.

Key Updates in PCI DSS v4.0.1

While v4.0.1 doesn’t change the substance of the standard, it provides clearer direction in several key areas. Here’s a closer look at what’s been updated:

1. Requirement 3 – Protect Stored Account Data

Clarifications have been added for issuers and support services around the use of keyed cryptographic hashes. This helps avoid confusion about how sensitive authentication data should be handled after authorisation.

2. Requirement 6 – Develop and Maintain Secure Systems

The 30-day patching cycle has been refined to apply only to critical vulnerabilities, rather than both critical and high. This ensures patch management efforts are prioritised correctly while maintaining strong security practices.

3. Requirement 8 – Identify Users and Authenticate Access

The update clarifies how multi-factor authentication (MFA) applies, especially when phishing-resistant authentication factors are used. If an account relies solely on such factors, additional layers of MFA may not be required.

4. Third-Party Service Providers (TPSPs)

The revised wording strengthens the expectations for shared responsibility between merchants and third-party providers. Businesses must now ensure that the PCI scope, documentation, and responsibilities of each TPSP are clearly defined and contractually agreed.

5. Payment Page Scripts and Client-Side Security

This area has caused confusion for many merchants using third-party payment pages or iframes. PCI DSS v4.0.1 now makes it clearer who is responsible for monitoring, approving, and maintaining client-side scripts, a critical step in preventing web-based skimming attacks.

These updates may appear subtle, but they’re essential for removing ambiguity. Clearer standards mean fewer delays during compliance assessments and fewer errors in interpretation, saving both time and money.

Why PCI DSS v4.0.1 Matters

Even though v4.0.1 doesn’t add new requirements, it’s still an important update that businesses can’t ignore. Here’s why:

In a world where cyber threats are becoming more complex, keeping ahead of regulatory changes like this is a clear sign of a proactive, trustworthy business.

How UK Businesses Should Prepare for PCI DSS v4.0.1

With the deadlines approaching, now is the time to start preparing. Here’s how your organisation can make a smooth transition to PCI DSS v4.0.1 compliance:

1. Conduct a Gap Analysis

Compare your current controls and policies against PCI DSS v4.0.1. Even if you’re already compliant under v4.0, these clarifications may reveal areas that need fine-tuning.

2. Review Your Scope

Reassess your Cardholder Data Environment (CDE) to confirm what systems, users, and service providers are involved. Scope creep is a common compliance pitfall, especially when using multiple third-party platforms or cloud services.

3. Update Documentation and Policies

Ensure that your policies, procedures, and training materials reflect the clarifications made in v4.0.1, particularly around patching, authentication, and script management.

4. Strengthen Third-Party Oversight

Engage your service providers early. Request proof of their PCI compliance, update your contracts, and make sure all shared responsibilities are clearly documented.

5. Review Patch and Vulnerability Management

Even though the patching rule has been narrowed, it’s a good opportunity to review your entire vulnerability management process. Timely updates and good documentation will always strengthen your compliance posture.

6. Audit Web Payment Pages

If your business takes payments online, ensure all client-side scripts are authorised, inventoried, and monitored for integrity. The clarified guidance makes this a shared responsibility, so coordinate with your payment processor.

7. Schedule Internal Audits and Staff Training

Don’t wait until Q1 2025. Hold internal assessments before the end of the year and refresh staff training on PCI processes and data handling.

By addressing these steps now, your business will be better placed to meet compliance with confidence and avoid last-minute disruption.