PCI DSS v4.0.1: What Merchants Need to Know

The Shift to PCI DSS v4.0.1

The Payment Card Industry Security Standards Council (PCI SSC) recently released PCI DSS v4.0.1, a limited revision to the standard that serves as a critical update for all organizations that process, store, or transmit cardholder data. While the major transition to the v4.x framework occurred with the release of v4.0 in 2022, v4.0.1 represents a necessary refinement based on industry feedback and stakeholder questions.

It is important for merchants to understand that v4.0.1 is not a new set of requirements. Instead, it is a housekeeping update designed to improve the usability and clarity of the existing standard. As of December 31, 2024, PCI DSS v4.0 will be retired, making v4.0.1 the only active version supported by the PCI SSC.

What Has Changed?

Because this is a limited revision, the PCI SSC has confirmed that there are no new or deleted requirements. The primary focus of v4.0.1 is to:

• Correct Errors: Fix typographical and formatting issues found in the previous version.
• Clarify Intent: Provide better guidance on the focus of specific requirements to remove ambiguity.
• Align Guidance: Update applicability notes to ensure consistent interpretation across the industry.

For example, some language has been adjusted to better align with previous versions (such as v3.2.1) where necessary for clarity, and specific guidance has been added regarding third-party service providers (TPSPs) and payment page script management.

The Timeline: What You Need to Know

While v4.0.1 is the current standard, it does not change the effective date for the future-dated requirements introduced in v4.0. Merchants must still prepare for the March 31, 2025, deadline when those new requirements become mandatory. Transitioning to v4.0.1 now ensures that your compliance documentation—including your Report on Compliance (ROC) or Self-Assessment Questionnaire (SAQ)—is aligned with the most current, supported version of the standard.

What Merchants Should Do

1. Review the Summary of Changes: Consult the official "Summary of Changes from PCI DSS v4.0 to v4.0.1" provided by the PCI SSC to understand exactly which sections were updated.
2. Update Your Documentation: Ensure your internal policies and procedures reflect the clarified language in v4.0.1. If you use SAQs, download the updated versions, as the PCI SSC has released new SAQs and AOCs to align with this revision.
3. Check Your Timeline: Remember that the March 31, 2025, deadline for v4.0 future-dated requirements remains unchanged. Use the remaining time to audit your security controls against these upcoming mandates.
4. Consult Your Assessor: If you work with a QSA (Qualified Security Assessor), discuss how the clarifications in v4.0.1 impact your specific environment, particularly if you utilize third-party services for payment page hosting.

ONKORE Perspective

At ONKORE, we view the release of v4.0.1 as a positive step toward reducing the friction often associated with complex compliance frameworks. By clarifying intent and fixing formatting errors, the PCI SSC is helping merchants focus their resources on what truly matters: the actual security of cardholder data. Rather than viewing this as "just another update," merchants should treat v4.0.1 as an opportunity to refine their security posture and ensure their compliance evidence is robust, clear, and ready for the upcoming March 2025 enforcement date.

Merchants must review the limited revisions in v4.0.1 to ensure their compliance programs align with the clarified requirements and stakeholder feedback.

Affected industries: Retail, E-commerce, Fintech, Hospitality, Healthcare

Download the latest SAQs from the PCI SSC Document Library.