Which version of PCI DSS applies to the validation?
PCI DSS v4.0.1. According to the PCI Security Standards Council, v4.0 was retired on December 31, 2024, and the requirements that had been future-dated became mandatory on March 31, 2025. One of them is an external vulnerability scan by an Approved Scanning Vendor at least every quarter, which NORBr runs weekly.
In detail
PCI DSS v4.0.1. According to the PCI Security Standards Council, v4.0 was retired on December 31, 2024, and the requirements that had been future-dated became mandatory on March 31, 2025. One of them is an external vulnerability scan by an Approved Scanning Vendor at least every quarter, which NORBr runs weekly.
PCI DSS v4.0.1
NORBr's validation is performed against PCI DSS v4.0.1, the only version in force. According to the PCI Security Standards Council, v4.0 was retired on December 31, 2024, and the requirements that had been future-dated in v4.0 became mandatory on March 31, 2025. Every assessment since then covers the full standard.
Examples of requirements now in force
- External vulnerability scans by an Approved Scanning Vendor at least every quarter. NORBr runs them weekly.
- Authenticated internal vulnerability scans.
- Management of payment page scripts and detection of unauthorized changes.
- Multi-factor authentication for all access to the cardholder data environment.
- Automated log review and detection of logging failures.
Why operators should check the version
An attestation referencing v4.0 or v3.2.1 is out of date and will not satisfy an acquirer. Operators should confirm that every provider in their chain, infrastructure, processors, hosting, has validated against v4.0.1 and that the attestation's scope covers the services they use. The responsibility matrix with each provider should state which v4.0.1 requirements the provider covers, so the operator's own assessment can reference them without duplicating the work.