PCI DSS compliance v4.0: Your requirements checklist

While a new version of PCI DSS, PCI DSS v4.0, will come to effect in March 2024, it's key to understand what PCI DSS v3.2.1 entailed before diving into the changes. Here's a quick refresh of the previous PCI standard, and then we'll cover everything you need to know about PCI DSS v4.0.

PCI DSS is a set of technical and operational requirements intended to protect account data, combat fraud, and reduce the chances of a data breach. Launched in 2006, PCI DSS was developed by the PCI Security Standards Council (PCI SSC), an independent body made up of MasterCard, Visa, American Express, JCB, and Discover. Currently, 12 core requirements make up the PCI DSS.

Any organization that interacts with the Cardholder Data Environment (CDE) – collecting, processing, storing, or transmitting account data – must comply with PCI DSS directly or through completing an annual assessment independently or together with your QSA. While it is not part of any law, the standard is applied around the world. Failure to meet PCI DSS may result in breaches, fines, or termination of credit card processing privileges.

Previous feedback suggested that the decimal points in “PCI DSS v3.2.1” were getting a little out of hand, and it was time for a rebrand. Just kidding. While the 12 core PCI DSS requirements remain fundamentally the same, the changes for PCI DSS v4.0 are to ensure account data is properly protected, and that businesses are clear on their responsibilities in making that happen.

As technology evolves, so do the attack tactics and capabilities of bad actors trying to compromise systems. There has also been an uptick of adoption digital wallets or contactless payments in Australia that kickstarted during the COVID-19 pandemic, and snowballed from there. More needs to be done to ensure the protection of account data.

That's where PCI DSS v4.0 comes in. The new guidelines are aligned with the latest changes and developments in the security landscape, while providing clearer guidance for businesses to follow.

The PCI Security Standards Council guided the creation of version 4.0 with four objectives. They are:

• To ensure the standard continues to meet the security needs of the payments industry

• To add flexibility and support of additional methodologies to achieve security

• To encourage businesses to view security as a continuous process

• To enhance validation methods and procedures to be more robust

PCI DSS v4.0 includes an expansion of requirements in developing security and technology areas, including mobile phones and tablets, contactless payments, cloud adaptation, new software development practices, and increased dependence on third parties.

With PCI DSS v4.0 in effect, here are some best practice tips to help you get all your security ducks in a row:

• Don’t use preset usernames, passwords, or factory settings

• Use strong passwords and unique user IDs – at least 7 character passwords (numeric, alphabetic, and special characters)

• Stay up to date with new software patches as soon as they’re released

If you maintain your compliance and keep control of your environment, you'll be well placed to meet PCI DSS v4.0 requirements. Remember, you can always check in with us for guidance. Our experts are more than ready to help you with the PCI DSS v4.0 requirements.

Implementing PCI DSS compliance in your business can seem intimidating, especially if you don't have an existing framework to properly protect account data.

To help reduce the scope of your PCI DSS compliance, Adyen offers integrations that handle most of the PCI DSS requirements for you:

• Our Web Drop-in or Components renders the available cards in your payment form, and securely collects any account data and sensitive card information, so it doesn't touch your server

• For a point-of-sale integration, you can use our default End-to-End Encryption (E2EE) solution

While you’ll still need to secure account data before it reaches us, we’re always here to help guide you in the right direction – so be sure to reach out if you have any questions in the meantime.

What are the 12 requirements of PCI DSS?

Before we dive into the 12 requirements of PCI DSS, it's important to understand what are the six guiding principles of the PCI SSC. All 12 requirements are linked to one of the six principles.

1. Build and maintain a secure network

2. Protect cardholder data

3. Maintain a vulnerability management program

4. Implement strong access control measures

5. Regularly monitor and test networks

6. Maintain an information security policy

The main focus of the 12 requirements set by PCI SSC is to protect card data of users. They are:

1. Install and maintain a firewall configuration to protect cardholder data

2. Do not use vendor-supplied defaults for system passwords and other security parameters

3. Protect stored cardholder data

4. Encrypt transmission of cardholder data across open, public networks 

5. Use and regularly update anti-virus software or programs

6. Develop and maintain secure systems and applications

7. Restrict access to cardholder data by business need to know

8. Assign a unique ID to each person with computer access

9. Restrict physical access to cardholder data

10. Track and monitor all access to network resources and cardholder data

11. Regularly test security systems and processes

12. Maintain a policy that addresses information security for all personnel

Find out more about the 12 requirements right here.

Is PCI compliance required by law in Australia?

PCI compliance is not required by law in Australia, nor in other markets. However, credit card providers enforce compliance through their contracts to ensure that the PCI DSS standard is met.

About the author: Helen Huyton guides Merchants on PCI DSS related topics with expertise in the risks involved per integration, how to mitigate the risks and which validation documentation is required in order to be PCI compliant.