Payment Card Industry

Data Security Standard

Summary of Changes fromPCI DSS Version 3.2.1 to 4.0
Revision 1
May 2022

Document Changes
Date

Revision

Initial release of the PCI DSS v3.2.1 to v4.0 Summary of Changes.

March 2022
May 2022

Description

1

Errata update to correct the change description for PCI DSS v4.0
Requirement 8.3.9.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page iTable of Contents
1

Introduction ........................................................................................................................................... 1

2

Change Types ....................................................................................................................................... 2

3

Summary of Changes to PCI DSS Introductory Sections ................................................................ 2

4

Summary of General Changes to PCI DSS Requirements ............................................................... 55

Additional Changes per Requirement ................................................................................................ 6

6

Summary of New Requirements ....................................................................................................... 28

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page ii

1

Introduction
This document provides a high-level summary and description of the changes from PCI DSS v3.2.1 toPCI DSS v4.0 and does not detail all document revisions. Due to the extent of the changes, thestandard should be reviewed in its entirety rather than focusing solely on this summary document.
This Summary of Changes is organized as follows:Change Types - provides an overview of the types of changes

Summary of Changes to PCI DSS Introductory Sections - summarizes changes made foreach affected section.



Summary of General Changes to PCI DSS Requirements - summarizes changes madethroughout the requirements, testing procedures, and guidance.

Additional Changes per Requirement - summarizes additional changes made inrequirements 1-12 and the appendices.



Summary of New Requirements - lists all new requirements, the entity to which the newrequirement applies (that is, all entities or service providers only), and the effective dateof the new requirement.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 1

2

Change Types
Change TypeDefinition

Evolving requirement

Changes to ensure that the standard is up to date with emerging threats andtechnologies, and changes in the payment industry. Examples include new or
modified requirements or testing procedures, or the removal of a requirement.

Clarification or guidance

Updates to wording, explanation, definition, additional guidance, and/or instruction
to increase understanding or provide further information or guidance on aparticular topic.

Structure or format

Reorganization of content, including combining, separating, and renumbering of
requirements to align content.

3

Summary of Changes to PCI DSS Introductory Sections
SectionDescription of Change

Change Type

Introduction and
PCI Data Security
Standard
Overview

Added “Limitations” sub-heading and clarified that
PCI DSS does not supersede county, state, or local
laws.
Expanded list of PCI DSS resources.

Clarification or
guidance

PCI DSS
Applicability
Information

PCI DSS
Applicability
Information

Added sub-headings to increase readability.
Clarification or
Clarified that some PCI DSS requirements may apply guidancefor entities that do not store, process, or transmit
primary account number (PAN).
Clarified that terms account data, sensitive
authentication data (SAD), cardholder data, and PAN
are not interchangeable and are used intentionally in
PCI DSS.
Clarified table with commonly used elements ofcardholder data and SAD, whether storage ispermitted, and whether data must be renderedunreadable.

Relationshipbetween PCI DSS
and PA-DSS

Relationshipbetween PCI DSS
and PCI SSC
SoftwareStandards

Refocused section on relationship between PCI DSS
and PCI SSC software standards, with mention of
PA-DSS (retiring in October 2022).

Evolving
requirement

Scope of PCI
DSS
Requirements

Scope of PCI
DSS
Requirements

Clarified applicability of PCI DSS requirements andthe definition of cardholder data environment (CDE).
Expanded examples of system components to which
PCI DSS applies; added cloud and other systemcomponents.
Added “Understanding PCI DSS Scoping” diagram.

Clarification or
guidance

PCI DSS v3.2.1

PCI DSS v4.0

Introduction and
PCI Data Security
Standard
Overview

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 2Section

Description of Change

Change TypePCI DSS v3.2.1

PCI DSS v4.0

Scope of PCI
DSS
Requirements

Scope of PCI
DSS
Requirements:
Annual PCI DSS
ScopeConfirmation

Added sub-heading and clarified existing content.

Appendix D:
Segmentation andSampling ofBusiness
Facilities/System
Components

Scope of PCI
DSS
Requirements:
Segmentation

Moved segmentation diagram formerly in Appendix
Clarification orD, with minor edits.
guidance
Retitled sub-section and updated references from‘network segmentation’ to ‘segmentation’ to support a
broader range of segmentation controls.

Scope of PCI
DSS
Requirements:
Wireless

Scope of PCI
DSS
Requirements:
Wireless

Clarified that rogue wireless detection (Requirement
11.2.1) must be performed even if wireless is not
used in the CDE and even if the entity has a policythat prohibits its use.

Clarification or
guidance

Scope of PCI
DSS
Requirements:
Encrypted
Cardholder Dataand Impact on
PCI DSS Scope

Added sub-section and related content.

Clarification or
guidance

Scope of PCI
DSS
Requirements:
Encrypted
Cardholder Dataand Impact to PCIDSS Scope for
Third-Party
Service Providers

Added new sub-section and related content.

Clarification or
guidance

Scope of PCI
DSS
Requirements:
Use of Third-party
Service
Providers/Outsour
cing

Scope of PCI
DSS
Requirements:
Use of Third-party
Service Providers

Retitled sub-section, added new content, andreorganized existing content under new subheadings.

Clarification or
guidance

Best Practices for
Implementing PCI
DSS into
Business-asUsual Processes

Best Practices for
Implementing PCI
DSS into
Business-asUsual Processes

Added guidance and clarifications throughout.

Clarification or
guidance

For Assessors:
Sampling ofBusiness
Facilities/System
Components

For Assessors:
Sampling for PCI
DSS
Assessments

Retitled section and updated throughout withClarification or
additional guidance and clarifications.
guidance
Clarified that sampling references were removed from
Testing Procedures to support assessors in selecting
samples that are appropriate to the population being
tested.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Clarification or
guidance

May 2022
Page 3

Section

Description of Change

Change TypePCI DSS v3.2.1

PCI DSS v4.0

Appendix D:
Segmentation andSampling ofBusiness
Facilities/System
Components

For Assessors:
Sampling for PCI
DSS
Assessments

Moved sampling diagram formerly in Appendix D,with minor edits.

Clarification or
guidance

Description ofTimeframes Usedin PCI DSS
Requirements

New section to clarify frequencies and timeframes
specified in PCI DSS and related expectations.
Added explanation of “significant change.”

Clarification or
guidance

Approaches for
Implementing andValidating PCI
DSS

New section to explain and illustrate the two
approaches, defined and customized, for
implementing and validating PCI DSS.

Evolving
requirement

Approaches for
Implementing andValidating PCI
DSSMoved content to this section, at a sub-heading under Structure or“Defined Approach.”formatProtecting
Information About
Entity’s Security
PostureNew section to describe how entities may handle
sensitive artifacts from their PCI DSS assessment.

Clarification or
guidance

Testing Methods
for PCI DSS
Requirements

New section to describe the testing methods used ineach PCI DSS Testing Procedures andcorresponding expected activities to be performed by
the assessor.

Clarification or
guidance

PCI DSS
Assessment
Process

Includes minor clarifications.
Moved note that starts “PCI DSS requirements are
not considered to be in place…” here, formerly in
Detailed PCI DSS Requirements and Security
Assessment Procedures.

Clarification or
guidance

Additional
References

New section that lists external organizations
Clarification orreferenced within PCI DSS requirements or guidance. guidance

Detailed PCI DSS
Requirements andTesting
Procedures

Replaced content on first page of section with an
Clarification orillustration that explains all elements of theguidance
Requirements column, Testing Procedures column,
and Guidance column.
To first page of section, added description for
Requirements noted with “Additional requirements forservice providers only.”
To first page of section, added summary of
appendices that include additional PCI DSS
requirements for different types of entities.

Compensating
Controls

PCI DSS
Assessment
Process

Detailed PCI DSS
Requirements andSecurity
Assessment
Procedures

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 4

4

Summary of General Changes to PCI DSS
Requirements
General Changes Implemented Throughout PCI DSS Requirements

Change Type

Reformatted overview sections and added a summary of the sections to the beginning of eachprincipal requirement.

Structure orformatUpdated overview sections and added guidance at the start of each requirement section.

Clarification or
guidance

Added numbered requirement description headings throughout each requirement to organize
and describe the requirements that fall under it.

Structure orformatRenumbered requirements and testing procedures and reorganized requirements due to theaddition of numbered requirement description headings.

Structure orformatRephrased directive requirements to be objective.

Evolving
requirement

Moved examples from requirements or testing procedures into the guidance column.

Structure orformatRemoved references to sampling from testing procedures.

Clarification or
guidance

Shortened testing procedures by clarifying testing is to be done “in accordance with allelements specified in this requirement” to minimize redundancy between requirements andtesting procedures.

Clarification or
guidance

Updated language in requirements and/or corresponding testing procedures for alignment andconsistency.

Clarification or
guidance

Enhanced testing procedures to clarify level of validation expected for each requirement.

Clarification or
guidance

Reformatted requirements and testing procedures and made minor wording changes forreadability – for example, content from paragraphs reformatted to bullet points.

Structure orformatCombined requirements that support the same intent and separated requirements that support
different intents.

Structure orformatSeparated complex requirements / testing procedures and removed redundant or overlapping
testing procedures.

Structure orformatMoved required elements that were included only in testing procedures to requirements, toclarify the requirement and to facilitate shortening of the testing procedures.

Clarification or
guidance

Moved and reworded policies and procedures requirements from the end to the beginning ofeach principal requirement.

Structure orformatRemoved notes about SSL/Early TLS from the guidance columns for requirements thatreferenced those specific protocols.

Clarification or
guidance

Changed “cardholder data” to “account data” as needed to align with usage and intent.

Clarification or
guidance

Changed terminology used to refer to frequency throughout the requirements in accordancewith Description of Timeframes Used in PCI DSS Requirements.

Clarification or
guidance

Added titles and reorganized content of the guidance column to aid understanding and merge
similar information.

Structure orformatPCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 55Additional Changes per Requirement
SectionPCI DSS v3.2.1

PCI DSS v4.0

Description of Change

Change Type

Requirement 1
Requirement 1- General

Updated principal requirement title to reflect the focus Evolving
on “network security controls.”
requirement
Replaced “firewalls” and “routers” with “network
security controls” to support a broader range oftechnologies used to meet the security objectives
traditionally met by firewalls.

1.1.5

1.1.2

Replaced requirement for “Description of groups,
Evolvingroles, and responsibilities for management of network requirement
components” with general requirement for roles andresponsibilities for Requirement 1.

1.1

1.2.1

Refocused former “null” requirement (all content
pointed to other requirements) on defining,
implementing, and maintaining configuration
standards for network security control rulesets.

Clarification or
guidance

1.1.1

1.2.2

Clarified that changes are managed in accordancewith the change control process defined at
Requirement 6.5.1.

Clarification or
guidance

1.1.4

Removed redundant requirement.

Clarification or
guidance

1.1.6

1.2.5
1.2.6

Separated into two requirements to clarify intent ofeach.

Clarification or
guidance

1.1.7

1.2.7

Clarified the intent of reviewing configurations of
network security controls at least once every six
months.

Clarification or
guidance

Removed “null” requirement (all content pointed toother requirements).

Structure orformat

1.2
1.2.2

1.2.8

Clarified the intent of securing configuration files.

Clarification or
guidance

1.2.1
1.3.4

1.3.1
1.3.2

Separated Requirement 1.2.1. into two requirements
to clarify intent of each.
Removed redundant Requirement 1.3.4.

Clarification or
guidance

1.2.3

1.3.3

Clarified the intent of implementing network security
controls between wireless networks and the CDE.

Clarification or
guidance

1.3

1.4.1

Refocused a former null requirement (all content
pointed to other requirements).
Clarified that the intent is to implement controls
between trusted and untrusted networks.

Clarification or
guidance

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 6

Section

Description of Change

Change TypePCI DSS v3.2.1

PCI DSS v4.0

1.3.1
1.3.2
1.3.5

1.4.2

Merged requirements to clarify that the intent is torestrict inbound traffic from untrusted networks.

Clarification or
guidance

1.3.6

1.4.4

Clarified the intent is that system components storing
cardholder data are not directly accessible from
untrusted networks.

Clarification or
guidance

1.4

1.5.1

Clarified that the intent is to implement security
controls on any computing device that connects toboth untrusted networks and the CDE.

Clarification or
guidance

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 7

Section

Description of Change

Change Type

Requirement 2 - General

Updated principal requirement title to reflect that thefocus is on secure configurations in general, and notjust on vendor-supplied defaults.

Clarification or
guidance

2.1.2

New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments

Evolving
requirement

2.1

2.2.2

Clarified that the intent is to understand whether
vendor default accounts are in use and to manage
them accordingly.

Clarification or
guidance

2.2.1

2.2.3

Clarified the intent of the requirement for managing
Clarification or
primary functions that require different security levels. guidance

2.2.2
2.2.5

2.2.4

Combined requirements to align similar topics.

2.2.3

2.2.5

Clarified that the intent of the requirement is if any
Clarification or
insecure services, protocols, or daemons are present. guidance

2.1.1

2.3.1
2.3.2

Split requirement for changing all wireless vendor
defaults into two requirements to clarify the focus of
each.

Clarification or
guidance

2.4

12.5.1

Moved requirement to align related content.

Structure orformatRemoved “null” requirement (all content pointed toother requirements).

Structure orformatPCI DSS v3.2.1

PCI DSS v4.0

Requirement 2

2.6

Structure orformatRequirement 3
Requirement 3 - General

3.1

Updated principal requirement title to reflect the focus Clarification or
on account data.
guidance

3.1.2

New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments.

3.2.1

New requirement bullet to address SAD stored prior Evolving
to completion of authorization through implementation requirementof data retention and disposal policies, procedures,and processes.
This bullet is a best practice until 31 March 2025.

3.3.2

New requirement to encrypt SAD that is stored
electronically prior to completion of authorization.
This requirement is a best practice until 31 March2025.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Evolving
requirement

Evolving
requirement

May 2022
Page 8

Section

Description of Change

Change TypePCI DSS v3.2.1

PCI DSS v4.0

3.2.a
3.2.b

3.3.3

Added a requirement to address former testing
Clarification orprocedures that any storage of SAD by issuers is
guidance
limited to that which is needed for a legitimate issuingbusiness need and is secured.

3.3

3.4.1

Clarified that PAN is masked when displayed suchthat only personnel with a business need can see
more than the BIN/last four digits of the PAN.

Evolving
requirement

12.3.10

3.4.2

New requirement for technical controls to prevent
copy and/or relocation of PAN when using remoteaccess technologies. Expanded from former
Requirement 12.3.10.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

3.4

3.5.1

Removed pads from the “Index tokens and pads”
bullet for rendering PAN unreadable.

Evolving
requirement

3.5.1.1

New requirement for keyed cryptographic hashes
when hashing is used to render PAN unreadable.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

3.5.1.2

New requirement that disk-level or partition-levelencryption is used only to render PAN unreadable onremovable electronic media or, if used on nonremovable electronic media, the PAN is also
rendered unreadable via a mechanism that meets
Requirement 3.5.1.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

3.6.1.1

New requirement bullet for service providers only Evolving
to include in the documented description of therequirement
cryptographic architecture that use of the same
cryptographic keys in production and test
environments is prevented.
This bullet is a best practice until 31 March 2025.

3.5.1

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 9Section
PCI DSS v3.2.1

Description of Change

PCI DSS v4.0

Change Type

Requirement 4
Requirement 4 - General

4.1

Updated principal requirement title to reflect the focus Clarification or
on “strong cryptography” to protect transmissions of
guidance
cardholder data.

4.1.2

New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments.

4.2.1

New requirement bullet to confirm certificates used Evolving
for PAN transmissions over open, public networks are requirement
valid and not expired or revoked.
This bullet is a best practice until 31 March 2025.

4.2.1.1

New requirement to maintain an inventory of trusted
keys and certificates.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

Evolving
requirement

Requirement 5
Requirement 5 - General

5.1.2

5.2

Updated principal requirement title to reflect the focus Clarification or
on protecting all systems and networks fromguidance
malicious software.
Replaced “anti-virus” with “anti-malware” throughout
to support a broader range of technologies used tomeet the security objectives traditionally met by antivirus software.

Evolving
requirement

5.1.2

New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments.

Evolving
requirement

5.2.3

Clarified requirement by changing focus to “systemcomponents that are not at risk for malware.”Clarification or
guidance

5.2.3.1

New requirement to define the frequency of periodic
evaluations of system components not at risk formalware in the entity’s targeted risk analysis.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

5.3.1
5.3.2
5.3.4

Split one requirement into three to focus eachrequirement on one area:

Clarification or
guidance•

Keeping the malware solution current via
automatic updates,•

Performing periodic scans and active or real-timescans (with a new option for continuous
behavioral analysis),•

Generation of audit logs by the malware solution.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 10

Section
PCI DSS v3.2.1

PCI DSS v4.0

Description of Change

Change Type5.3.2.1

New requirement to define the frequency of periodic
malware scans in the entity’s targeted risk analysis.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

5.3.3

New requirement for a malware solution forremovable electronic media.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

5.4.1

New requirement to detect and protect personnel
against phishing attacks.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

Requirement 6 - General

Updated principal requirement title to include“software” rather than “applications.”
Clarified that Requirement 6 applies to all systemcomponents, except for Requirement 6.2, whichapplies only to bespoke and custom software.

Clarification or
guidance

6.1.2

New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments.

Evolving
requirement

6.2.1

Moved requirement for developing software securely
to align all software development content under
Requirement 6.2.

Structure orformatReplaced “internal and external” with “bespoke andcustom” software.
Clarified that this requirement applies to softwaredeveloped for or by the entity for the entity’s own use
and does not apply to third-party software.

Clarification or
guidance

Requirement 6

6.3

6.5

6.2.2

Moved the elements of Requirement 6.5 for trainingof software developers to align all softwaredevelopment content under Requirement 6.2.
Clarified training requirements for softwaredevelopment personnel.

Clarification or
guidance

6.3.2

6.2.3
6.2.3.1

Moved requirement for reviewing custom softwareprior to release to align all software development
content under Requirement 6.2.
Split requirement to separate general code review
practices from those needed if manual code reviews
are performed.

Clarification or
guidance

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 11

Section

Description of Change

Change Type

6.2.4

Moved requirements for addressing common coding
vulnerabilities to align all software development
content under Requirement 6.2.
Combined methods to prevent or mitigate common
software attacks into a single requirement andgeneralized the language describing each type ofattack.

Clarification or
guidance

6.1
6.2

6.3

Moved requirements for identifying security
vulnerabilities and protecting system components
from vulnerabilities via patching under Requirement
6.3.

Structure orformat6.1

6.3.1

Added a bullet to clarify applicability to vulnerabilities
for bespoke and custom and third-party software.

Clarification or
guidance

6.3.2

New requirement to maintain an inventory of
bespoke and custom software.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

6.4.1

Moved requirement for addressing new threats andvulnerabilities for public-facing web applications
under Requirement 6.4.

Structure orformat6.4.2

New requirement to deploy an automated technicalsolution for public-facing web applications that
continually detects and prevents web-based attacks.
This new requirement removes the option in
Requirement 6.4.1 to review web applications via
manual or automated application vulnerability
assessment tools or methods.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

6.4.3

New requirement for management of all payment
page scripts that are loaded and executed in the
consumer’s browser.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

6.3.1
6.4
6.4.1 – 6.4.6

6.5.1 – 6.5.6

Moved and combined requirements for changes tosystem components under Requirement 6.5.

Structure orformat

6.4

6.5.3
6.5.4
6.5.5
6.5.6

Removed requirement for specific documented
procedures and added testing procedures to verify
policies and procedures to each related requirement.

Clarification or
guidance

6.4.1

6.5.3

Changed term from “development/test andproduction” to “production and pre-production”
environments.

Clarification or
guidance

PCI DSS v3.2.1

PCI DSS v4.0

6.5.1 – 6.5.10

6.6

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 12

Section

Description of Change

Change TypePCI DSS v3.2.1

PCI DSS v4.0

6.4.2

6.5.4

Changed term from “development/test andClarification or
production” to “production and pre-production”
guidance
environments.
Changed term “separation of duties” and clarified that
separation of roles and functions between production
and pre-production is intended to provide
accountability so that only approved changes are
deployed.

6.4.3

6.5.5

Changed term from “testing or development” to “preproduction” environments.
Clarified that live PANs are not used in preproduction environments except where all applicable
PCI DSS requirements are in place.

Clarification or
guidance

Requirement 7 - General

Updated principal requirement title to include systemcomponents and cardholder data.

Clarification or
guidance

7.1.2

New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments.

Evolving
requirement

7.1

7.2.1
7.2.2
7.2.3

Removed requirement for specific documented
procedures and added testing procedures to verify
policies and procedures to each related requirement.

Clarification or
guidance

7.1.1

7.2.1

Clarified requirement is about defining an access
control model.

Clarification or
guidance

7.1.2
7.1.3

7.2.2

Combined requirements for assigning access based Structure oron job classification and function, and least privileges. format

7.1.4

7.2.3

Clarified requirement is about approval of required
privileges by authorized personnel.

7.2.4

New requirement for review of all user accounts and Evolving
related access privileges.
requirement
This requirement is a best practice until 31 March
2025.

7.2.5

New requirement for assignment and managementof all application and system accounts and related
access privileges.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

7.2.5.1

New requirement for review of all access by
application and system accounts and related accessprivileges.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

Requirement 7

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Clarification or
guidance

May 2022
Page 13

Section
PCI DSS v3.2.1

PCI DSS v4.0

8.7

7.2.6

7.2

Description of Change

Change Type

Moved requirement since it aligns better with thecontent in Requirement 7.

Structure orformatRemoved “null” requirement (all content pointed toother requirements).

Structure orformatStandardized on terms “authentication factor” and“authentication credentials.”
Removed “non-consumer users” and clarified in theoverview that requirements do not apply to accounts
used by consumers (cardholders).

Clarification or
guidance

Requirement 8
Requirement 8 - General

Removed note in overview that listed requirements
Structure orthat do not apply to user accounts with access to only format
one card number at a time to facilitate a single
transaction and added that note to each related
requirement.
8.1.2

New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments.

Evolving
requirement

8.1.1

8.2.1

Added a note that this requirement is not intended toapply to user accounts on point-of-sale terminals thathave access to only one card number at a time tofacilitate a single transaction.

Clarification or
guidance

8.5

8.2.2

Changed focus of requirement to allow use of sharedauthentication credentials, but only on an exception
basis.

Evolving
requirement

Added a note that this requirement is not intended toapply to user accounts on point-of-sale terminals thathave access to only one card number at a time tofacilitate a single transaction.

Clarification or
guidance

8.5
8.5.1

8.2.2
8.2.3

Moved requirements for group, shared, or generic
Structure oraccounts and for service providers with remoteformataccess to customer premises under Requirement 8.2.

8.1.8

8.2.8

Added a note that this requirement is not intended toapply to user accounts on point-of-sale terminals thathave access to only one card number at a time tofacilitate a single transaction.

Structure orformat8.2

8.3.1

Added a note that this requirement is not intended toapply to user accounts on point-of-sale terminals thathave access to only one card number at a time tofacilitate a single transaction.

Structure orformatPCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 14

Section
PCI DSS v3.2.1

PCI DSS v4.0

8.1.6
8.1.7

8.3.4

Description of Change

Change Type

Merged requirements and moved under Requirement Structure or
8.3
formatAdded a note that this requirement is not intended toapply to user accounts on point-of-sale terminals thathave access to only one card number at a time tofacilitate a single transaction.
Increased the number of invalid authentication
attempts before locking out a user ID from six to 10
attempts.

Evolving
requirement

8.2.6

8.3.5

Clarified that this requirement applies only if
passwords/passphrases are used as anauthentication factor to meet Requirement 8.3.1.

Clarification or
guidance

8.2.3

8.3.6

New requirement to increase password length froma minimum length of seven characters to minimum
length of 12 characters (or if the system does notsupport 12 characters, a minimum length of eightcharacters).
This requirement is a best practice until 31 March
2025.
Clarified that, until 31 March 2025, passwords must
be a minimum length of at least seven characters inaccordance with v3.2.1 Requirement 8.2.3.
Clarified that this requirement applies only if
passwords/passphrases are used as anauthentication factor to meet Requirement 8.3.1.
Added a note that this requirement is not intended toapply to user accounts on point-of-sale terminals thathave access to only one card number at a time tofacilitate a single transaction.

Evolving
requirement

8.2.5

8.3.7

Added a note that this requirement is not intended toapply to user accounts on point-of-sale terminals thathave access to only one card number at a time tofacilitate a single transaction.

Structure orformat8.4

8.3.8

Moved content about communicating user
authentication policies and procedures under
Requirement 8.3.

Structure orformat

8.2.4

8.3.9

Clarified that this requirement applies if
Clarification or
passwords/passphrases are used as the only
guidanceauthentication factor for user access (i.e., in any
single-factor authentication implementation).
Added a note that this requirement is not intended toapply to user accounts on point-of-sale terminals thathave access to only one card number at a time tofacilitate a single transaction.
Added a note that this requirement does not apply toservice providers’ customer accounts, but does apply
to accounts for service provider personnel.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 15

Section

Description of Change

Change TypePCI DSS v3.2.1

PCI DSS v4.0

8.2.4

8.3.9

Added the option to determine access to resources
automatically by dynamically analyzing the security
posture of accounts, instead of changing
passwords/passphrases at least once every 90 days.

8.2.4.b8.3.10Moved content from a former testing procedure to a
Structure or
requirement for service providers to provide guidance format
to customers about changing passwords/
passphrases.
Added a note that this requirement will besuperseded by Requirement 8.3.10.1 once
Requirement 8.3.10.1 becomes effective.

8.3.10.1

New requirement for service providers only – if
Evolving
passwords/passphrases are the only authentication
requirement
factor for customer user access, thenpasswords/passphrases are either changed at least
once every 90 days or access to resources is
automatically determined by dynamically analyzing
the security posture of the accounts.
This requirement is a best practice until 31 March
2025.
Added a note that this requirement does not apply to
accounts of consumer users accessing their payment
card information.
Added a note that this requirement will supersede
Requirement 8.3.10 once it becomes effective, anduntil that date, service providers may meet either
Requirement 8.3.10 or 8.3.10.1.

8.3.11

Moved requirement about authentication factors such Structure oras physical or logical security tokens, smart cards,
formatand certificates under Requirement 8.3.

8.6

8.3

Evolving
requirement

Removed “null” requirement (all content pointed toother requirements).

Structure orformat8.4.2

New requirement to implement multi-factor
authentication (MFA) for all access into the CDE.
This requirement is a best practice until 31 March
2025.
Added a note to clarify that MFA is required for bothtypes of access specified in Requirements 8.4.2 and8.4.3; and that applying MFA to one type of accessdoes not replace the need to apply another instanceof MFA to the other type of access.

Evolving
requirement

8.5.1

New requirement for secure implementation of multi- Evolving
factor authentication systems.
requirement
This requirement is a best practice until 31 March2025.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 16

Section
PCI DSS v3.2.1

8.7

PCI DSS v4.0

Description of Change

Change Type

8.6.1

New requirement for management of system orapplication accounts that can be used for interactive
login.
This requirement is a best practice until 31 March
2025.

8.6.2

New requirement for not hard-coding
Evolving
passwords/passphrases into files or scripts for any
requirement
application and system accounts that can be used forinteractive login.
This requirement is a best practice until 31 March
2025.

8.6.3

New requirement for protecting
passwords/passphrases for application and system
accounts against misuse.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

7.2.6

Moved requirement since it aligns better with thecontent in Requirement 7.

Structure orformat

Evolving
requirement

Requirement 9
Requirement 9 - GeneralIn the overview, clarified the three different areas
Clarification or
covered in Requirement 9 (sensitive areas, CDE, and guidance
facilities).
Throughout, clarified whether each requirement
applies to the CDE, sensitive areas, or facilities.

9.1.2

New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments.

Evolving
requirement

9.1

9.2.4

Added a requirement to address a former testingprocedure bullet to restrict access to consoles insensitive areas via locking when not in use.

Clarification or
guidance

9.2

9.3.1
9.3.2

Split requirement for identifying personnel and visitors Structure or
into separate requirements, Requirements 9.3.1 and format
9.3.2 respectively.

9.4
9.4.1
9.4.2

9.3.2

Combined requirements for authorizing andmanaging visitor access together in Requirement
9.3.2.

9.5
9.5.1

9.4.1
9.4.1.1
9.4.1.2

Removed requirement for procedures to physically
Clarification or
secure media (9.5) and merged the procedures into
guidance
the related requirements.
Split requirement for storing media backups in asecure location and reviewing the security of theoffline backup location at least every 12 months into 2
requirements.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Structure orformatMay 2022
Page 17

Section

Description of Change

Change TypePCI DSS v3.2.1

PCI DSS v4.0

9.6
9.6.1
9.6.2
9.6.3

9.4.2
9.4.3
9.4.4

Removed requirement for procedures for internal and Clarification or
external distribution of media (9.6) and merged theguidance
procedures into the related requirements.

9.7
9.7.1

9.4.5
9.4.5.1

Removed requirement for procedures for strict control Clarification orover storage and accessibility of media (9.7) andguidance
merged the procedures into the related requirements.
Split requirement for maintaining media inventorylogs and conducting media inventories annually into 2
requirements.

9.8
9.8.1
9.8.2

9.4.6
9.4.7

Removed requirement for procedures for media
Clarification or
destruction when media is no longer needed (9.8)
guidance
and merged the procedures into the related
requirements.
Clarified options for destroying media when no longer
needed includes either destruction of electronic
media or rendering cardholder data unrecoverable.

9.9

9.5.1

Clarified the focus of the requirement is on “Point-ofinteraction (POI) devices that capture payment card
data via direct physical interaction with the payment
card form factor.”
Clarified that this requirement applies to deployed
POI devices used in card-present transactions.

9.5.1.2.1

New requirement to define the frequency of periodic Evolving
POI device inspections based on the entity’s targeted requirement
risk analysis.
This requirement is a best practice until 31 March
2025.

Clarification or
guidance

Requirement 10
Requirement 10 - General

Updated principal requirement title to reflect focus on Clarification or
audit logs, system components, and cardholder data. guidance
Clarified that these requirements do not apply to user
activity of consumers (cardholders).
Replaced “Audit trails” with “Audit logs” throughout.
New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments.

Evolving
requirement

10.2

Removed “null” requirement (all content pointed toother requirements).

Structure orformat10.5

Removed “null” requirement (all content pointed toother requirements).

Structure orformatMoved audit log protection requirements under
Requirement 10.3.

Structure orformat10.1.210.5.1 – 10.5.5

10.3.1 – 10.3.4

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 18

Section
PCI DSS v3.2.1

PCI DSS v4.0

10.5.310.5.410.3.3

Description of Change

Change Type

Combined requirements to align similar topics.

Structure orformatRemoved “null” requirement (all content pointed toother requirements).

Structure orformat

10.4.1 – 10.4.3

Moved requirements for audit log reviews under
Requirement 10.4.

Structure orformat

10.4.1.1

New requirement for the use of automatedmechanisms to perform audit log reviews.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

10.4.2.1

New requirement for a targeted risk analysis todefine the frequency of periodic log reviews for allother system components (not defined in
Requirement 10.4.1)
This requirement is a best practice until 31 March
2025.

Evolving
requirement

10.7

10.5.1

Moved requirement for audit log history to 10.5.1.

Structure orformat10.4
10.4.1 – 10.4.3

10.6.1 – 10.6.3

Moved and reorganized requirements for timesynchronization under 10.6.

Structure orformat10.8

10.7.1

Moved requirement for service providers to detect,alert, and promptly address failures of critical control
systems to Requirement 10.7.1.

Structure orformat10.7.2

New requirement for all entities to detect, alert, andpromptly address failures of critical security control
systems.
This requirement is a best practice until 31 March
2025.
This new requirement applies to all entities - it
includes two additional critical security controls notincluded in Requirement 10.7.1 for service providers.

Evolving
requirement

10.7.3New requirement to respond promptly to failures ofany critical security controls.
For service providers: this is current PCI DSS v3.2.1
requirement.
For all other (non-service provider) entities: this is a
new requirement.
This requirement is a best practice (for non-service
providers) until 31 March 2025.

Evolving
requirement

10.6
10.6.1 – 10.6.3

10.8.1PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 19

Section
PCI DSS v3.2.1

Description of Change

PCI DSS v4.0

Change Type

Requirement 11
Requirement 11 - General

Minor update to principal requirement title.

Clarification or
guidance

11.1.2

New requirement for roles and responsibilities.
This requirement is effective immediately for all v4.0
assessments.

Evolving
requirement

11.2.1Clarified the intent of the requirement is to manage
both authorized and unauthorized wireless accesspoints.
Clarified that this requirement applies even when apolicy exists to prohibit the use of wirelesstechnology.

Clarification or
guidance

11.3.1.1

New requirement to manage all other applicablevulnerabilities (those not ranked as high-risk or
critical) found during internal vulnerability scans.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

11.3.1.2

New requirement to perform internal vulnerabilityscans via authenticated scanning.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

11.2.311.3.1.3
11.3.2.1

Separated requirement to perform internal andexternal vulnerability scans and rescans after any
significant changes into a requirement for internalscans (11.3.1.3) and external scans (11.3.2.1).

Structure orformat11.3

11.4.1Clarified the following:

Clarification or
guidance

11.1

11.3.3•The methodology is defined, documented, andimplemented by the entity.

•

Penetration testing results are retained for atleast 12 months.

•

The methodology includes a documented
approach to assessing and addressing risk
posed by exploitable vulnerabilities and security
weaknesses found during penetration testing.

•

The meaning of testing from inside the network(internal penetration testing) and from outside the
network (external penetration testing).

11.4.4

Clarified that penetration test findings are corrected in Clarification oraccordance with the entity’s assessment of the risk
guidance
posed by the security issue.

11.4.7

New requirement for multi-tenant service
providers to support their customers for external
penetration testing.
This requirement is a best practice until 31 March2025.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Evolving
requirement

May 2022
Page 20

Section
PCI DSS v3.2.1

PCI DSS v4.0

Description of Change

Change Type11.5.1.1

New requirement for service providers to use
intrusion-detection and or intrusion-prevention
techniques to detect, alert on/prevent, and address
covert malware communication channels.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

11.6.1

New requirement to deploy a change-and-tamperdetection mechanism to alert for unauthorized
modifications to the HTTP headers and contents of
payment pages as received by the consumer
browser.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

Removed “null” requirement (all content pointed toother requirements).

Structure orformat11.2
11.1.212.10.5

Moved requirement for incident response procedures Structure or
if unauthorized wireless access points are detected to formatalign with other incident response items.

11.5.1

12.10.5

Moved requirement to respond to alerts generated by Structure or
the change-detection solution to align with other theformatincident response items.

Requirement 12
Requirement 12 - General

Updated principal requirement title to reflect that thefocus is on organizational policies and programs that
support information security.

Clarification or
guidance

12.2

Removed requirement for a formal organization-widerisk assessment and replaced with specific targetedrisk analyses (12.3.1 and 12.3.2).

Evolving
requirement

12.4

12.1.3

Added formal acknowledgment by personnel of their
responsibilities.

Evolving
requirement

12.5
12.5.1 – 12.5.5

12.1.4

Clarified that responsibilities are formally assigned toa Chief Information Security Officer or otherknowledgeable member of executive management.
Merged requirements for formally assigning
responsibility for information security.

Clarification or
guidance

12.3
12.3.1 – 12.3.9

12.2.1Clarified the intent of the requirement is for
acceptable use policies for end-user technologies.
Merged and removed requirements to focus on
explicit management approval, acceptable uses oftechnologies, and a list of hardware and software
products approved by the company for employee
use.

Clarification or
guidance

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 21

Section

Description of Change

Change TypePCI DSS v3.2.1

PCI DSS v4.0

12.3.10

3.4.2

Removed requirement and added new Requirement
3.4.2 for technical controls to prevent copy and/or
relocation of PAN when using remote-accesstechnologies.

Evolving
requirement

12.3.1

New requirement to perform a targeted risk analysis
for any PCI DSS requirement that provides flexibility
for how frequently it is performed.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

12.3.2

New requirement for entities using a Customized
Approach to perform a targeted risk analysis foreach PCI DSS requirement that the entity meets withthe customized approach.
This requirement is effective immediately for all
entities undergoing a v4.0 assessment and using acustomized approach.

Evolving
requirement

12.3.3New requirement to document and review
cryptographic cipher suites and protocols in use atleast once every 12 months.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

12.3.4

New requirement to review hardware and software
technologies in use at least once every 12 months.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

12.11
12.11.1

12.4.212.4.2.1

Moved requirements for reviews to confirm that
personnel are performing PCI DSS tasks inaccordance with policies and procedures under
Requirement 12.4, to align with other requirements
for managing PCI DSS compliance activities.

Structure orformat2.4

12.5.1

Moved under Requirement 12.5 to align with otherrequirements for documenting and validating PCI
DSS scope.

Structure orformat12.5.2

New requirement to document and confirm PCI DSS Evolving
scope at least every 12 months and upon significant requirementchange to the in-scope environment.
This requirement is effective immediately for all v4.0
assessments.

12.5.2.1

New requirement for service providers to
document and confirm PCI DSS scope at least once
every six months and upon significant change to thein-scope environment.
This requirement is a best practice until 31 March2025.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Evolving
requirement

May 2022
Page 22

Section
PCI DSS v3.2.1

12.6

12.6.1
12.6.2

PCI DSS v4.0

Description of Change

Change Type12.5.3New requirement for service providers for a
documented review of the impact to PCI DSS scope
and applicability of controls upon significant changes
to organizational structure.
This requirement is a best practice until 31 March
2025.

12.6.1Clarified that the intent is that all personnel are aware Clarification orof the entity’s information security policy and their role guidancein protecting cardholder data.

12.6.2

New requirement to review and update (as needed)
the security awareness program at least once every
12 months.
This requirement is a best practice until 31 March
2025.

12.6.3Merged requirements for security awareness training. Structure orformat12.6.3.1

New requirement for security awareness training toinclude awareness of threats and vulnerabilities that
could impact the security of the CDE.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

12.6.3.2

New requirement for security awareness training toinclude awareness about the acceptable use of enduser technologies in accordance with Requirement
12.2.1.
This requirement is a best practice until 31 March
2025.

Evolving
requirement

Removed “null” requirement (all content pointed toother requirements).

Structure orformat12.8

Evolving
requirement

Evolving
requirement

12.8.1 – 12.8.5

12.8.1 – 12.8.5

Replaced “Service Provider” with Third-Party Service
Provider (TPSP).
Clarified that the use of a PCI DSS compliant TPSP
does not make an entity PCI DSS compliant, nordoes it remove the entity’s responsibility for its own
PCI DSS compliance.

Clarification or
guidance

12.8.212.8.2

Replaced “Service Provider” with Third-Party Service
Provider (TPSP).

Clarification or
guidance

12.8.312.8.3Replaced “Service Provider” with Third-Party Service
Provider (TPSP).

Clarification or
guidance

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 23

Section

Description of Change

Change TypePCI DSS v3.2.1

PCI DSS v4.0

12.8.412.8.4

Replaced “Service Provider” with Third-Party Service Clarification orProvider (TPSP).
guidance
Clarified that where an entity has an agreement witha TPSP for meeting PCI DSS requirements on behalfof the entity, the entity must work with the TPSP to
make sure the applicable PCI DSS requirements are
met. If the TPSP does not meet those applicable PCI
DSS requirements, then those requirements are also
“not in place” for the entity.

12.8.512.8.5

Replaced “Service Provider” with Third-Party Service
Provider (TPSP).
Clarified that the information about PCI DSS
requirements managed by the TPSP and the entity
should include any that are shared between the
TPSP and the entity.

Clarification or
guidance

12.9.2

New requirement for service providers to support
their customers’ requests for information to meet
Requirements 12.8.4 and 12.8.5.
This requirement is effective immediately for all v4.0
assessments.

Evolving
requirement

Removed “null” requirement (all content pointed toother requirements).

Structure orformat12.10
12.10.1

12.10.1

Replaced “system breach” and “compromise” with“suspected or confirmed security incident.”

Clarification or
guidance

12.10.3

12.10.3

Replaced “alerts” with “suspected or confirmed
security incidents.”

Clarification or
guidance

12.10.4

12.10.4

Replaced “system breach” with “suspected orconfirmed security incidents.”

Clarification or
guidance

12.10.4.1

New requirement to perform a targeted risk analysis Evolving
to define the frequency of periodic training for incident requirement
response personnel.
This requirement is a best practice until 31 March
2025.

12.10.5

Merged requirements and updated the security
monitoring systems to be monitored and responded
to as part of the incident response plan to include thefollowing:

12.10.5
11.1.2
11.5.1•

Detection of unauthorized wireless access points(former 11.1.2),•

Change-detection mechanism for critical files(former 11.5.1),

Evolving
requirement

New requirement bullet for use of a changeand tamper-detection mechanism for payment
pages (relates to new requirement 11.6.1).
This bullet is a best practice until 31 March 2025.

•

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 24Section
PCI DSS v3.2.1

PCI DSS v4.0
12.10.7

Description of Change
New requirement for incident response procedures
to be in place and initiated upon detection of stored
PAN anywhere it is not expected.
This requirement is a best practice until 31 March2025.

Change Type
Evolving
requirement

Appendix A1Appendix A1 - General

Updated principal requirements title to reflect focus
Clarification or
on multi-tenant service providers.
guidance
Updated requirement overview to describe multitenant service providers and their environments, andto clarify responsibilities between multi-tenant service
providers and their customers.
Updated “shared hosting provider” to “multi-tenant
hosting provider” throughout.

A1

Removed “null” requirement (all content pointed toother requirements).

A1.4

Structure orformatA1.1.1

New requirement for to implement logical separation Evolving
between providers’ environments and customers’
requirement
environments.
This requirement is a best practice until 31 March
2025.

A1.1.4

New requirement to confirm, via penetration testing,the effectiveness of logical separation controls used
to separate customer environments.
This requirement is a best practice until 31 March
2025.

A1.2.3New requirement for the implementation of
Evolving
processes and mechanisms for reporting andrequirement
addressing suspected or confirmed security incidents
and vulnerabilities.
This requirement is a best practice until 31 March
2025.

A1.2.2

Replaced “compromise” with “suspected or confirmed Clarification or
security incident”
guidance

Evolving
requirement

Appendix A2
The only changes made to Appendix A2 were to add the requirement description heading at
A2.1 and to renumber the three requirements as A2.1.1, A2.1.2, and A2.1.3.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Clarification or
guidance

May 2022
Page 25

Section

Description of Change

Change Type

Appendix A3 - General

Clarified that other PCI standards may referencecompletion of this Appendix.
Clarified that not all PCI DSS requirements apply to
all entities that undergo a PCI DSS assessment,
which is why some PCI DSS requirements are
duplicated in this Appendix. Any questions about thisAppendix should be addressed to acquirers or
payment brands.

Clarification or
guidance

A3.2.1A3.2.1

Updated the elements included for PCI DSS scope
documentation and confirmation to align with new
PCI DSS Requirement 12.5.2.

Evolving
requirement

A3.3.1

New requirement bullet to detect, alert, and report
failures of automated log review mechanisms.
New requirement bullet to detect, alert, and report
failures of automated code review tools.
These bullets are best practices until 31 March 2025.

Evolving
requirement

Appendix B:
Compensating
Controls

Appendix B:
Compensating
Controls

Clarified that compensating controls may be
Clarification orconsidered when an entity cannot meet a PCI DSS
guidance
requirement explicitly as written, due to “legitimate
and documented technical or business constraints.”
Updated item 2 to mention the Customized Approach
Objective and its use to understand the intent of most
PCI DSS requirements.
Clarified the intent of item 4 is to address the risk
imposed by not adhering to the PCI DSS
requirement.
Added item 6 to clarify that compensating controls
are used to address requirements currently and in the
future, and they cannot be used to address arequirement missed in the past.

Appendix C:
Compensating
Controls
Worksheet

Appendix C:
Compensating
Controls
Worksheet

Clarified that the intent is for the entity to use theClarification orworksheet to define its compensating controls.
guidance
Updated item 1 to “Document the legitimate technicalor business constraints precluding compliance withthe original requirement.”
Reordered the worksheet items to move item 4 toitem 2.
Updated item 3 to mention the Customized Approach
Objective, and split item into two parts to “Define theobjective of the original control” and to “Identify theobjective met by the compensating control.”Removed the Compensating Control Worksheet Completed Example. An updated completed example
will be included in a separate guidance document.

Appendix D:
Customized
Approach

New Appendix to explain and provide instructions for Clarification or
the Customized Approach.
guidance

PCI DSS v3.2.1

PCI DSS v4.0

Appendix A3

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 26

Section
PCI DSS v3.2.1

Appendix E:
SampleTemplates to
SupportCustomized
Approach

Appendix D:
Segmentation andSampling ofBusiness
Facilities/ System
Components

Description of Change

Change TypeNew Appendix for example templates for thecontrols matrix and targeted risk analysis, to be
documented by the entity as part of the customized
approach.
Clarified that entities are not required to follow thespecific template formats, but must provide all
information as defined in each template.
Includes two templates:

Clarification or
guidance

PCI DSS v4.0•

E1 Sample Controls Matrix Template•

E2 Sample Targeted Risk Analysis Template.

Appendix F:
Leveraging the
PCI Software
Security
Framework to
SupportRequirement 6

New Appendix to describe how an entity can meetseveral requirements in Requirement 6 by use of
bespoke or custom software that is developed andmaintained in accordance with one of PCI SSC’s
Secure Software Standards.

Clarification or
guidance

Appendix G: PCI
DSS Glossary ofTerms,
Abbreviations,and Acronyms

New Appendix for the PCI DSS v4.0 Glossary.
General updates to the Glossary include:

Clarification or
guidance•

Added new terms based on updated
requirements or based on feedback,•Removed common terms that can be readilyfound with other sources,•

Removed terms not used in PCI DSS v4.0,•

Shortened acronym definitions.

Removed Appendix and moved former content tosections titled “Segmentation” and “For Assessors:
Sampling for PCI DSS Assessments.”

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

Clarification or
guidance

May 2022
Page 27

6

Summary of New Requirements
As noted in the table below, the new requirements included in PCI DSS v4.0 are either:

Effective immediately for all PCI DSS v4.0 assessments.
ORBest practices until 31 March 2025, after which they become effective.
Applicable to
New Requirement

Service
Providers
Only

Immediately
for all v4.0
Assessments

31 March
2025

2.1.2

Roles and responsibilities for performing
activities in Requirement 2 are
documented, assigned, and understood.





3.1.2

Roles and responsibilities for performing
activities in Requirement 3 are
documented, assigned, and understood.





3.2.1

Any SAD stored prior to completion of
authorization is kept to a minimum
through implementation of data retention
and disposal policies, procedures, andprocesses.





3.3.2

SAD stored electronically prior tocompletion of authorization is encryptedusing strong cryptography.





3.3.3

SAD stored by issuers is encryptedusing strong cryptography.

3.4.2

Technical controls to prevent copy
and/or relocation of PAN when using
remote-access technologies except with
explicit authorization.

Hashes used to render PAN unreadable(per the first bullet of Requirement 3.5.1)
are keyed cryptographic hashes of theentire PAN with associated keymanagement processes and procedures.



3.5.1.2

Implementation of disk-level or partitionlevel encryption when used to render
PAN unreadable.



3.6.1.1

A documented description of thecryptographic architecture includes
prevention of the use of cryptographic
keys in production and test
environments.

3.5.1.1

1

All
Entities

Effective Date

1







Applicable only to issuers and companies that support issuing services and store sensitive authentication data.

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 28

Applicable to
New Requirement

All
Entities

Service
Providers
Only

Effective Date
Immediately
for all v4.0
Assessments

31 March
2025

4.1.2

Roles and responsibilities for performing
activities in Requirement 4 are
documented, assigned, and understood.



4.2.1

Certificates used to safeguard PAN
during transmission over open, public
networks are confirmed as valid and are
not expired or revoked.



4.2.1.1

An inventory of the entity’s trusted keys
and certificates is maintained.





5.1.2

Roles and responsibilities for performing
activities in Requirement 5 are
documented, assigned, and understood.



5.2.3.1

A targeted risk analysis is performed todetermine frequency of periodic
evaluations of system components
identified as not at risk for malware.



5.3.2.1

A targeted risk analysis is performed todetermine frequency of periodic malware
scans.





5.3.3

Anti-malware scans are performed whenremovable electronic media is in use.





5.4.1

Mechanisms are in place to detect andprotect personnel against phishingattacks.





6.1.2

Roles and responsibilities for performing
activities in Requirement 6 are
documented, assigned, and understood.



6.3.2

Maintain an inventory of bespoke andcustom software to facilitate vulnerability
and patch management.





6.4.2

Deploy an automated technical solution
for public-facing web applications that
continually detects and prevents webbased attacks.





6.4.3

Manage all payment page scripts thatare loaded and executed in the
consumer’s browser.





7.1.2

Roles and responsibilities for performing
activities in Requirement 7 are
documented, assigned, and understood.



7.2.4

Review all user accounts and related
access privileges appropriately.



PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.










May 2022
Page 29

Applicable to
New Requirement

All
Entities

Service
Providers
Only

Effective Date
Immediately
for all v4.0
Assessments

31 March
2025

7.2.5

Assign and manage all application andsystem accounts and related accessprivileges appropriately.



7.2.5.1

Review all access by application andsystem accounts and related accessprivileges.





8.1.2

Roles and responsibilities for performing
activities in Requirement 8 are
documented, assigned, and understood.



8.3.6

Minimum level of complexity forpasswords when used as anauthentication factor.



8.3.10.1

If passwords/passphrases are the only
authentication factor for customer user
access, passwords/passphrases arechanged at least every 90 days or the
security posture of accounts isdynamically analyzed to determine realtime access to resources.









8.4.2

Multi-factor authentication for all accessinto the CDE.





8.5.1

Multi-factor authentication systems are
implemented appropriately.





8.6.1

Manage interactive login for accounts
used by systems or applications.





8.6.2

Passwords/passphrases used forinteractive login for application andsystem accounts are protected against
misuse.





8.6.3

Passwords/passphrases for any
application and system accounts areprotected against misuse.





9.1.2

Roles and responsibilities for performing
activities in Requirement 9 are
documented, assigned, and understood.



9.5.1.2.1

A targeted risk analysis is performed todetermine frequency of periodic POI
device inspections.



10.1.2

Roles and responsibilities for performing
activities in Requirement 10 are
documented, assigned, and understood.



10.4.1.1

Audit log reviews are automated.



PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.








May 2022
Page 30

Applicable to
New Requirement

All
Entities

Service
Providers
Only

Effective Date
Immediately
for all v4.0
Assessments

31 March2025

10.4.2.1

A targeted risk analysis is performed todetermine frequency of log reviews forall other system components.



10.7.2

Failures of critical security control
systems are detected, alerted, andaddressed promptly.



10.7.3

Failures of critical security control
systems are responded to promptly.



11.1.2

Roles and responsibilities for performing
activities in Requirement 11 are
documented, assigned, and understood.



11.3.1.1

Manage all other applicablevulnerabilities (those not ranked as highrisk or critical).



11.3.1.2

Internal vulnerability scans are
performed via authenticated scanning.



11.4.7

Multi-tenant service providers support
their customers for external penetration
testing.

11.5.1.1

Covert malware communication
channels detect, alert and/or prevent,and address via intrusion-detection
and/or intrusion-prevention techniques.







11.6.1

A change-and-tamper-detection
mechanism is deployed for payment
pages.



12.3.1

A targeted risk analysis is documented
to support each PCI DSS requirementthat provides flexibility for how frequently
it is performed.



12.3.2A targeted risk analysis is performed foreach PCI DSS requirement that is met
with the customized approach.



12.3.3

Cryptographic cipher suites andprotocols in use are documented andreviewed.



12.3.4

Hardware and software technologies arereviewed.



12.5.2

PCI DSS scope is documented andconfirmed at least once every 12
months.



PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.



May 2022
Page 31

Applicable to
New Requirement

All
Entities

Service
Providers
Only

Effective Date
Immediately
for all v4.0
Assessments

31 March2025

12.5.2.1

PCI DSS scope is documented andconfirmed at least once every six months
and upon significant changes.



12.5.3The impact of significant organizationalchanges on PCI DSS scope isdocumented and reviewed and results
are communicated to executive
management.



12.6.2The security awareness program isreviewed at least once every 12 months
and updated as needed.



12.6.3.1

Security awareness training includes
awareness of threats that could impact
the security of the CDE, to include
phishing and related attacks and social
engineering.



12.6.3.2

Security awareness training includes
awareness about acceptable use of enduser technologies.



12.9.2TPSPs support customers’ requests toprovide PCI DSS compliance status andinformation about PCI DSS requirementsthat are the responsibility of the TPSP.



12.10.4.1

A targeted risk analysis is performed todetermine frequency of periodic training
for incident response personnel.



12.10.5

The security incident response plan
includes alerts from the change- andtamper-detection mechanism forpayment pages.



12.10.7

Incident response procedures are inplace and initiated upon detection of
PAN.





A1.1.1

The multi-tenant service provider
confirms access to and from customer
environment is logically separated toprevent unauthorized access.

The multi-tenant service provider
confirms effectiveness of logicalseparation controls used to separate
customer environments at leave once
every six months via penetration testing.



A1.1.4

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 32

Applicable to
New Requirement

A1.2.3A3.3.1

All
Entities

Service
Providers
Only

The multi-tenant service provider
implements processes or mechanisms
for reporting and addressing suspected
or confirmed security incidents andvulnerabilities.
Failures of the following are detected,
alerted, and reported in a timely manner:
Automated log review mechanisms
Automated code review tools.

Totals:

Effective Date
Immediately
for all v4.0
Assessments







53

31 March
2025



11

13

51

Grand Total: 64

PCI DSS v3.2.1 to v.4.0 Summary of Changes r1© 2006 - 2022 PCI Security Standards Council, LLC. All rights reserved.

May 2022
Page 33