What is PCI DSS 4.0? Goals, requirements, and who must comply
PCI DSS 4.0 protects payment card data and replaced 3.2.1, which retired in March 2024.
It binds anyone handling cardholder data; non-compliance risks fines, breach costs, and lost processor contracts.
Chainguard Containers reduce the toil and time needed to achieve PCI DSS 4.0 compliance.
PCI DSS 4.0, or Payment Card Industry Data Security Standard, is a global standard in the payments industry that includes a set of foundational technical and operational requirements surrounding the protection of payment data. Its goal is to ensure the security of information involved when payment cards are used and while those payments are processed. PCI DSS 4.0 replaces the earlier PCI DSS 3.2.1, which was retired in March 2024.
Cashless transactions have become the norm around the world. This is a convenient way for buyers and sellers to transact business. It has also attracted the attention of criminals looking for easy money. Payment account information, and especially payment card and card-owner data, are especially targeted. All payment system stakeholders have a responsibility to secure this information. PCI DSS helps to alleviate vulnerabilities and protect payment account data.
This guide will provide a comprehensive overview of PCI DSS 4.0, detailing its practices, the importance of compliance, and practical guidance on meeting its requirements. At the end of this guide, you will learn how Chainguard Containers can be used to significantly reduce the toil and time needed to achieve PCI DSS 4.0 compliance.
Who is required to be compliant?
The PCI Security Standards Council (PCI SSC) is a global forum for the industry to come together to develop, enhance, disseminate, and assist with the understanding of security standards for payment account security.
The standards developed are agreed upon by all members and provide a measure of mutual trust across the industry. The standards are not directly developed or required by governmental entities. The PCI DSS is not a law, but compliance is enforced by the PCI SSC using a yearly assessment.
Participation and membership in the PCI SSC is open globally to those affiliated with the payments industry. Compliance is expected of all members and validated using the PCI DSS 4.0 and is assessed using a set of defined testing procedures to verify requirements are met.
Membership in the PCI SSC includes:
Merchants
Banks
Processors
Hardware and software developers
Point of sale vendors
Payment brands
, such as Visa, Mastercard, and American Express
Participation in the PCI SCC is encouraged for all industry stakeholders and is required for any who wish to participate in reviewing proposed additions or modifications to the standards.
Regardless of membership status, all entities that store, process, or transmit cardholder data and/or sensitive authentication data are expected to comply with PCI DSS requirements.
What is the importance of protecting payment account data?
Lax security enables criminals to steal and use consumer financial information from payment transactions and processing systems for fraudulent purposes. Vulnerabilities may appear anywhere in the card-processing ecosystem, including but not limited to:
Point of sale devices
Cloud-based systems
Mobile devices, personal computers, and servers
Wireless hotspots
Web shopping applications
Paper-based storage systems
The transmission of cardholder data to service providers
Remote access connections
These vulnerabilities may also extend to systems operated by service providers, such as the financial institutions that initiate and maintain the relationships with merchants that accept payment cards.
Compliance with PCI DSS helps to alleviate these vulnerabilities and protect payment account data.
Impact of non-compliance
PCI DSS is designed to protect both customers and entities that handle payment data. Beyond the following, a failure to comply leaves you and your customers vulnerable to data and financial losses, most of which are preventable.
Further, any entity that handles covered data and does not comply with PCI DSS requirements can expect:
Fines and penalties from contracted partners, such as payment processors
Data breach compensation costs, beyond just the initial losses
Legal action
A damaged reputation
These consequences may further result in cancelled contracts, additional revenue losses, and even closures.
PCI DSS practices
PCI DSS 4.0, or Payment Card Industry Data Security Standard is intended for all entities that store, process, or transmit cardholder data and/or authentication data that could impact the security of the cardholder data environment. This includes all entities interacting with information such as the following:
Cardholder Data |
Primary account number |
Cardholder name |
Expiration date |
Authentication Data |
Full track data, such as on a magnetic stripe or chip |
Card verification code (the number on the back) |
PINs |
PCI DSS 4.0 requires compliance with a set of requirements, each related to an information security practice or goal. All of these are intended to protect cardholder data from theft and fraud.
PCI DSS 4.0 goals and requirements
Below is a table overview with a high-level description of the goals and requirements, summarized from the PCI DSS v4.0 Quick Reference Guide from the PCI Security Standards Council, available from their Document Library:
Goals | Requirements |
Build and maintain a secure network and systems | Install and maintain network security controls and apply secure configurations to all system components |
Protect account data | Protect stored account data as well as during transmission over open, public networks |
Maintain a vulnerability management program | Protect all systems and networks from malicious software, develop and maintain secure systems and software |
Implement strong access control measures | Restrict access to system components and cardholder data by business need to know, identify users and authenticate access to system components, restrict physical access to cardholder data |
Regularly monitor and test networks | Log and monitor all access to system components and cardholder data, test security of all systems regularly |
Maintain an information security policy | Support information security with organizational policies and programs |
For a list of all required practices, refer to the PCI DSS documentation available in the PCI Security Standards Council’s Document Library.
Achieving compliance with PCI DSS 4.0 is not just an industry self-regulatory requirement but a critical step in safeguarding payment information. To prepare your organization for PCI DSS 4.0, read about how Chainguard Containers can help simplify fulfilling PCI DSS 4.0 requirements.
Related articles