PCI DSS 4.0 introduced a number of new requirements that were treated as best practice until March 31, 2025. Since then, they are part of every assessment.
Where to look first
- Targeted risk analysis for controls with flexible frequency
- Multi-factor authentication for all access to the cardholder data environment
- Protection of payment pages against script tampering
- Automated review of audit logs
If you are not sure where your gaps are, a short readiness review is the fastest way to find out.
