When the PCI Security Standards Council (PCI SSC) released PCI DSS v4.0.1, many business owners asked the same question: do we have to start over? The short answer is no. Version 4.0.1 is a limited revision. It cleans up wording and answers questions that came up after v4.0 was released, but it does not add new work. This article explains what changed, what did not, and what it means for your next assessment.
The key dates
The Council published PCI DSS v4.0.1 on 2024-06-11. Version 4.0 remained available until it was retired on 2024-12-31. Since then, assessments are performed against v4.0.1.
The Council was clear that the revision did not change the effective date of the future-dated requirements. Those requirements, 51 of the 64 new requirements introduced in v4.0, became effective on 2025-03-31. If you delayed work on them hoping the new version would push the deadline back, it did not.
What the limited revision changed
In the Council’s own words, there are no additional or deleted requirements in this revision. The changes are clarifications, corrections and formatting. The most practical ones are:
- Requirement 3 (stored account data): clarified how certain requirements apply to card issuers and to the use of keyed cryptographic hashes.
- Requirement 6 (secure systems and software): the 30-day deadline for installing security patches was brought back to applying only to critical vulnerabilities. Wording on managing scripts on payment pages was also clarified.
- Requirement 8 (authentication): a note was added about multi-factor authentication and phishing-resistant authentication factors.
- Requirement 12 (policies and programs): clarified the relationship between customers and third-party service providers.
- Appendices: sample templates were removed from Appendix E, and definitions were added for terms such as “legal exception”, “phishing-resistant authentication” and “visitor”.
All of this is summarized in the Council’s announcement, which also points to a detailed summary of changes. If your team works from the standard itself, that summary is worth reading line by line.
What did not change
For most organizations, the more important message is what stayed the same:
- The twelve principal requirements and the overall structure of the standard.
- The two ways to meet a requirement: the defined approach and the customized approach.
- The new v4.0 requirements, including those that became mandatory on 2025-03-31, such as broader multi-factor authentication, targeted risk analyses and controls on payment page scripts.
- Your obligation to validate compliance each year with the form your acquirer or the payment brands require.
In other words, a programme built for v4.0 is still valid. You need to update references, not rebuild controls.
Supporting documents followed
A new standard version means new reporting forms. The Council released a Report on Compliance (ROC) template for v4.0.1 and, in October 2024, Self-Assessment Questionnaires (SAQs) for v4.0.1. If you self-assess, make sure you are using the current SAQ, not a copy saved on a shared drive two years ago. SAQ A was revised again in early 2025, which we cover in a separate article.
What to do now
- Update your documentation. Policies, procedures and evidence binders that cite “v4.0” should now refer to v4.0.1.
- Revisit your patching procedure. Confirm that your 30-day rule targets critical vulnerabilities and that you have a documented, risk-based timeline for everything else.
- Check your service provider agreements. The Requirement 12 clarifications are a good prompt to confirm, in writing, who is responsible for which control.
- Confirm the future-dated requirements are operating. Assessors now expect evidence that these controls work in practice, not just a plan.
- Use the current forms. Download the latest SAQ or ROC template directly from the PCI SSC document library.
The bottom line
PCI DSS v4.0.1 is a maintenance release. It removes ambiguity and fixes a few points that caused friction, but it does not raise the bar. The real work for most Canadian merchants and service providers remains the v4.0 requirements that have been in force since 2025-03-31.
Not sure where your programme stands against v4.0.1? Our PCI DSS overview explains the standard in plain language. Ubitrak, a PCI SSC Qualified Security Assessor company since 2011, performs PCI DSS assessments, and the Accel PCI portal helps smaller merchants complete their SAQ. If gaps turn up, KW Consulting can help with remediation. Contact us to discuss your situation.
Sources
Does this apply to you? A free 30-minute consult maps the requirement to your systems and tells you what to do next.
Book a free consult