What is the difference between PCI DSS v4.0 and v4.0.1?
Version 4.0.1, published in June 2024, is a limited revision that clarifies wording and corrects errors without adding requirements. The PCI Security Standards Council retired v4.0 on December 31, 2024, so every assessment since then uses v4.0.1, including the requirements that became mandatory on March 31, 2025.
In detail
Version 4.0.1, published in June 2024, is a limited revision that clarifies wording and corrects errors without adding requirements. The PCI Security Standards Council retired v4.0 on December 31, 2024, so every assessment since then uses v4.0.1, including the requirements that became mandatory on March 31, 2025.
A limited revision
PCI DSS v4.0 was published in March 2022 as a major update, with new requirements phased in until March 2025. Version 4.0.1, published in June 2024, corrects errors and clarifies wording in v4.0. It adds no requirements and changes no deadlines. Its purpose is to remove ambiguities that assessors and companies had flagged.
Dates that matter
- 31 March 2024: PCI DSS v3.2.1 retired; v4.x becomes the only valid version.
- 31 December 2024: v4.0 retired; assessments use v4.0.1 from then on.
- 31 March 2025: the requirements marked as future-dated in v4.0 become mandatory.
What operators should check
That their last assessment and their providers' attestations reference v4.0.1, and that the formerly future-dated requirements, such as targeted risk analyses, authenticated internal scans and protection of payment pages against script tampering, are covered. Operators that use a hosted checkout from a validated provider should confirm how that provider meets the payment page requirements, since those are among the ones most often questioned.