Limited Revision Planned for PCI DSS v4.0

To address stakeholder feedback and questions received since PCI DSS v4.0 was published in March 2022, PCI SSC is planning a limited revision of the standard. Proposed changes include correcting format and typographical errors and clarifying the focus and intent of some of the requirements and guidance. There will not be any new or additional requirements in this revision.  

To support this limited revision, the PCI Board of Advisors, Global Executive Assessor Roundtable, and Principal Participating Organizations (through the Technology Guidance Group) are invited to review and provide feedback on the proposed changes during a Request for Comments (RFC) period. The RFC will be open for six weeks, from 13 December 2023 to 24 January 2024. 

Feedback from this RFC will help ensure that the proposed changes, clarifications, and additional guidance effectively support industry adoption of PCI DSS v4.0. Publication of the resulting revision is expected for the first half of 2024. 

RFC feedback plays a critical role in the ongoing maintenance and development of PCI standards and resources for the payment industry. 

To learn more about PCI SSC’s Principal Participating Organizations, Board of Advisors, and Global Executive Assessor Roundtable, visit the “Get Involved” page.  

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts