Confessions of a QSA: PCI DSS Version 4.0

October 12, 2022
Sonia Gossai

In March of 2022, the Security Standard’s Council released version 4.0 of its Payment Card Industry Data Security Standard (PCI DSS.) Weaver’s IT Advisory Services’ Kyle Morris, Senior Manager, and Brittany George, Partner, spoke to Tyler Kern about the new standard and what people need to know on this episode of the show.

PCI DSS 4.0 applies to entities storing, processing, and transmitting cardholder data or could affect the security of cardholder data. Kyle said this includes merchants who sell goods and services and get paid with a credit or debit card, like a Visa or Mastercard as well as service providers and other entities that support these merchants. “So, that can affect many different types of organizations.”

Version 4.0 came out this past March, but the new standards do not take effect until March 31, 2024. This will give merchants and service providers time to prepare for the latest compliance standard. There is also a transitional period, said Kyle. “Entities will have another year on top of 2024, to March 31, 2025, to implement some of the new requirements going into place.”

“You can opt-in early for version 4.0,” Brittany said. “It is fine for organizations that are ready to do that. It is actually considered a best practice.”

What are some of the changes in the latest version? “One key difference is the approach to implementing PCI,” Brittany said. “We currently have the defined approach, the traditional method of implementing the requirements as stated. Version 4.0 will introduce the customized approach, which is an alternative way of implementing the requirements.”

This customized approach offers the ability to implement the controls in an advanced way, for example through machine learning. “Organizations, including many or our clients, have been asking for this for years, especially those who have been on the leading edge of technology,” Kyle said.

Recent Episodes

Venture Fund Valuations
View episode

In this episode of The Alternative Edge, a Weaver: Beyond the Numbers Podcast, host Becky Reeder, an audit partner and co-leader of the alternative investments practice at Weaver, engages with Sindhu Rajesh, an Alternative Investment Services Partner with Weaver. They unpack the complexities of venture fund valuations, offering critical insights into industry dynamics and best […]

sales tax compliance strategies
View episode

In this episode of Weaver’s Beyond the Numbers, Brandon Hayes, a senior manager in Sales and Use Tax Practice, leads a crucial discussion about sales tax issues and sales tax compliance strategies. Joining him are Stephen Scarborough, partner in the State and Local Tax Compliance Group, and Shane Stewart, the partner in charge of the […]

Wayfair vs. South Dakota
View episode

In this Weaver Beyond the Numbers episode, Steven Scarborough, Mayur Naik, and Brandon Hayes review the implications of the Wayfair vs. South Dakota case. As e-commerce continues to dominate the market, understanding the nuances of sales tax and economic presence becomes crucial for businesses. Key Points: The Wayfair vs. South Dakota case determined that companies […]