Understanding PCI DSS v4.0.1: What US Merchants Need to Know About the Latest Revision

The landscape of payment security is constantly shifting, and for US merchants, staying ahead of the curve is not just a matter of security—it is a matter of compliance. Recently, the PCI Security Standards Council (PCI SSC) published a limited revision to the Payment Card Industry Data Security Standard, designated as PCI DSS v4.0.1. While this update is described as a "housekeeping" revision, its implications for your annual assessment and long-term security strategy are significant.

The Nature of the v4.0.1 Revision

It is important to clarify what PCI DSS v4.0.1 is—and what it is not. According to the PCI Security Standards Council, this version is a limited revision intended to address stakeholder feedback and questions received since the initial publication of v4.0 in March 2022.

Crucially, there are no new requirements added in this version, nor have any existing requirements from the core standard been deleted. Instead, the update focuses on:

• Typographical Corrections: Fixing minor errors and formatting issues that appeared in the original v4.0 text.
• Clarification of Intent: Providing clearer guidance on the focus and intent of specific requirements to reduce ambiguity during assessments.
• Alignment of Guidance: Ensuring that the additional guidance provided within the standard effectively supports industry adoption.

This revision was not developed in a vacuum. The PCI SSC engaged in a Request for Comments (RFC) period from December 2023 through January 2024, involving the Board of Advisors, Global Executive Assessor Roundtable, and Principal Participating Organizations to ensure the changes met the needs of the broader payment ecosystem Just Published: PCI DSS v4.0.1.

Key Timelines and Retirement Dates

For merchants currently in the middle of a transition from the now-retired v3.2.1, the introduction of v4.0.1 adds a new milestone to the calendar.

1. December 31, 2024: This is a critical date. PCI DSS v4.0 will be officially retired on this day. After this point, PCI DSS v4.0.1 will be the only active version of the standard supported by the Council.
2. March 31, 2025: Despite the release of v4.0.1, the effective date for the "future-dated" requirements introduced in v4.0 remains unchanged. Merchants still have until the end of March 2025 to fully implement these more complex technical requirements PCI DSS 4.0.1 Update - Amplix.

Notable Clarifications for Merchants

While the core requirements remain the same, the clarifications in v4.0.1 provide much-needed detail in several high-impact areas. According to industry analysis of the revision, these include:

Script Inventory and Management

One of the most discussed additions in v4.0 was the requirement for managing scripts on payment pages. Version 4.0.1 provides enhanced guidance on the scope of script inventories and how to address security-impacting HTTP headers. This is particularly relevant for e-commerce merchants who rely on third-party scripts for analytics, chatbots, or advertising PCI DSS v4.0.1: Key Updates and Clarifications.

Third-Party Service Provider (TPSP) Guidance

Requirement 12 has been updated to include more detailed guidance specifically tailored for TPSPs. As many US merchants rely on a complex web of service providers to handle cardholder data, these clarifications help define the boundaries of responsibility between the merchant and their partners PCI DSS v4.0.1: Key Updates and Clarifications.

SAQ A Adjustments

In a significant move for smaller e-commerce merchants, the Council has released updated Self-Assessment Questionnaires (SAQs). Notably, for merchants eligible for SAQ A (those using iFrames or redirects), certain requirements related to the management of payment page scripts—specifically 6.4.3 and 11.6.1—have been removed from the SAQ A template to better align with the risk profile of those environments Important PCI DSS v4.0.1 Update for E-commerce Merchants | Schellman.

What Merchants Should Do

Transitioning to a new version of a standard, even a limited revision, requires a structured approach. We recommend the following steps for US merchants:

1. Download the Summary of Changes: The PCI SSC has published a "Summary of Changes from PCI DSS v4.0 to v4.0.1." This document is the best resource for identifying exactly where wording has been adjusted PCI Security Standards Council Document Library.
2. Update Your Assessment Templates: If your next annual assessment falls after December 31, 2024, you must use the v4.0.1 Report on Compliance (ROC) or SAQ templates. Ensure your internal teams or Qualified Security Assessors (QSAs) are using the latest versions released by the Council.
3. Review E-commerce Scripting: If you are an e-commerce merchant, pay close attention to the clarifications regarding Requirement 6.4.3 and 11.6.1. Even if you use SAQ A, understanding the Council's intent regarding script security is vital for your overall security posture.
4. Maintain Momentum for March 2025: Do not let this revision distract you from the 51 future-dated requirements that become mandatory on March 31, 2025. These include significant technical hurdles like multi-factor authentication (MFA) for all access into the cardholder data environment and automated log reviews Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x.

ONKORE Perspective

At ONKORE, we view the release of PCI DSS v4.0.1 as a positive sign of a maturing standard. The transition from v3.2.1 to v4.0 was the most significant shift in a decade, and it was inevitable that real-world implementation would reveal areas where the language was either too vague or technically inconsistent. By addressing these "housekeeping" items now, the PCI SSC is providing merchants with a more stable foundation for their compliance efforts. However, merchants should not mistake "limited revision" for "unimportant." In the world of auditing, clarity is everything. A clearer understanding of the Council's intent reduces the risk of a failed assessment and ensures that security resources are being deployed where they matter most. We encourage all merchants to treat v4.0.1 as the definitive roadmap for their 2025 security planning.