PCI DSS v4.0: What’s Changed and What You Need to Do Now

PCI DSS V4.0 is the latest global standard for protecting payment card data. It replaced the old version in March 2024. If your business takes card payments, this update affects you directly.

For businesses in Australia and New Zealand, this is not just a global IT update. It is a real compliance requirement with real consequences. Banks, card networks and regulators now expect you to meet PCI DSS v4.0 in full. This guide explains what changed, what you risk if you ignore it, and exactly what steps to take right now.

Table of Contents

1. What Is PCI DSS v4.0?
2. The 7 Biggest Changes in PCI DSS v4.0
3. Old Rules vs New Rules: At a Glance
4. What Happens If You Are Not Compliant in Australia and New Zealand
5. Your 7-Step Action Plan
6. How Cyber Security Risk Management Connects to PCI DSS
7. Conclusion
8. FAQs

What Is PCI DSS v4.0?

PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of security rules for any business that handles card payments. This includes merchants, payment processors and service providers.

PCI DSS v4.0 is the biggest update to this standard in over a decade. It was released in March 2022 and became fully mandatory on March 31, 2025. The old version, v3.2.1, is now retired. If you are still following the old rules, you are already non-compliant.

The new version moves away from a once-a-year compliance audit. It now treats security as a daily business practice. That is a big shift for most organizations.

The 7 Biggest Changes in PCI DSS v4.0

Here is what actually changed and why it matters to your business:

1. MFA Is Now Mandatory for All CDE Access

Multi-factor authentication used to be required only for remote access. Under PCI DSS v4.0, MFA is now required for all access into the cardholder data environment. This means every staff member who touches card data must verify their identity in two steps. No exceptions.

2. Passwords Must Now Be 12 Characters Long

The old standard required passwords to be at least seven characters. PCI DSS v4.0 raises this to 12 characters. This applies to all accounts that access cardholder data systems. Short passwords are no longer acceptable.

3. Firewalls Are Now Called Network Security Controls

This is not just a name change. The updated term covers a much wider range of technologies. Cloud security tools, software-defined networks, and zero-trust systems now all fall under this requirement. Your network protection needs to address modern threats, not just rely on traditional firewalls.

4. Phishing Protection Is Now a Formal Requirement

PCI DSS v4.0 requires businesses to have both technical tools and staff training to stop phishing attacks. You cannot just run annual security awareness sessions anymore. You need active, automated systems that detect and block phishing attempts in real time.

5. Payment Page Scripts Must Be Actively Monitored

If you run an online store, every script that loads on your payment page must be tracked and approved. You also need a system that alerts you if any script is changed or tampered with. This targets so-called Magecart attacks where hackers inject hidden code to steal card details.

6. You Can Now Customise Your Compliance Approach

PCI DSS v4.0 introduces a new Customised Approach. Businesses can now design their own security controls as long as they meet the same objective. This gives larger and more complex organizations flexibility. But it requires strong documentation and independent testing to prove it works.

7. Compliance Is Now a Daily Process, Not a Yearly Audit

The biggest shift in PCI DSS v4.0 is the change in mindset. Security is no longer something you tick off once a year. You need defined roles, continuous monitoring, and documented processes that run every day. Think of it as ongoing cybersecurity risk management, not a checkbox exercise.

Old Rules vs New Rules: At a Glance

Here is a simple comparison of what changed and what it means for your business:

What Happens If You Are Not Compliant in Australia and New Zealand

This is the section most blogs skip. But it is the most important one for Australian and New Zealand businesses.

Non-compliance with PCI DSS v4.0 can result in serious consequences. Here is what you actually risk:

Fines From Card Networks

Visa, Mastercard, and other card networks can issue fines to your acquiring bank. Those fines get passed directly to you. Penalties can range from thousands to hundreds of thousands of dollars, depending on your transaction volume and the severity of the breach.

Loss of Card Payment Processing Rights

In serious cases, your bank or payment processor can revoke your ability to accept card payments altogether. For most businesses, this is a fatal outcome. No card payments means no revenue.

Liability Under the Australian Privacy Act

A payment card data breach almost always triggers the Australian Privacy Act and the Notifiable Data Breaches scheme. You must notify affected customers and the Office of the Australian Information Commissioner. Failure to do so carries its own penalties on top of the PCI fines.

Reputation Damage That Lasts

Customers in Australia and New Zealand are increasingly aware of data security. A publicised card data breach can permanently damage trust in your brand. The reputational cost often far exceeds any financial fine.

PCI DSS v4.0 and v4.0.1: Which Version Applies?

This trips up a lot of businesses. Here’s the version timeline in plain English:

• PCI DSS v3.2.1: retired 31 March 2024. Gone.
• PCI DSS v4.0: retired 31 December 2024. Also gone.
• PCI DSS v4.0.1:the sole active version from January 2025 onwards.

And the critical 2026 milestone: the 51 future-dated requirements inside v4.0.1 became fully mandatory on 31 March 2025. Every single one. Therefore, if your last proper assessment was done under v3.2.1, or even early v4.0, you have a compliance gap right now whether you know it or not.

All assessments conducted in 2026 are against PCI DSS v4.0.1, and every requirement is in scope. In short, understanding the full PCI DSS v4.0.1 requirements is no longer optional; it’s a baseline expectation. The transition period has ended. This is the current standard. Of course, getting PCI DSS compliance right means assessing against every single v4.0.1 requirement, not an older version.

Does Your Business Actually Need PCI DSS Compliance?

Run through this honestly.

• Do you accept credit or debit card payments? → Yes, PCI DSS compliance applies directly
• Do you use a third-party payment processor like Stripe or PayPal? → Still yes, you are responsible for monitoring their compliance and your integration
• Does your checkout page load any third-party scripts? → Yes, script management requirements apply to you
• Do you store any card data, even temporarily in logs or forms? → Definitely yes, full CDE rules apply
• Do you use a hosted checkout that redirects customers away from your site? → Possibly SAQ A eligible, but only if the redirect is complete and no scripts from your domain touch the payment page
• Think you qualify for simple SAQ A because you use Stripe? → Check carefully. SAQ A eligibility is now strict. Overall, if your checkout page is not a complete redirect, meaning your domain serves any part of the payment page or runs any script on it, you do not qualify for SAQ A. Many businesses using embedded Stripe elements fall outside SAQ A without realising it.

If you ticked yes on more than one of those, achieving active, documented PCI DSS compliance not just a payment provider agreement.

The 5 Most Common Compliance Gaps We See

We see the same PCI DSS compliance patterns repeatedly. In short, these are the gaps that come up in almost every gap assessment we run.

Gap 1: Assuming the payment gateway handles everything. It handles the transaction. It doesn’t handle your compliance. You still own your checkout environment, your scripts, your internal access controls, and your service provider monitoring.

Gap 2: MFA only on remote access, not internal systems. Feels compliant. Isn’t. Of course, under v4.0.1, every user accessing your payment systems needs MFA, full stop.

Gap 3: No documented analysis requirement documentation. The team knows what they’re doing, but nothing is formally documented. Specifically, when the QSA asks for the TRA, there’s nothing to show. That defaults you to the hardest compliance path automatically.

Gap 4: No script inventory or tamper detection on checkout pages. Most businesses have Google Analytics, chat widgets, and marketing pixels running on every page, including checkout. None of them is authorised or monitored. That’s a direct v4.0.1 finding.

Gap 5: Relying on last year’s SAQ without reassessing. The standard changed. For example, what passed last year may not pass this year. If you haven’t done a PCI DSS gap assessment against v4.0.1 specifically, you don’t actually know where you stand.

Your 7-Step Action Plan

Here is exactly what you need to do right now to meet PCI DSS v4.0:

Step 1: Do a Gap Analysis

Compare your current security setup against all 64 new or updated PCI DSS v4.0 requirements. Find out where you are compliant and where the gaps are. This is your starting point. You cannot fix what you have not measured.

Step 2: Enable MFA for All CDE Access

Start with multi-factor authentication. Identify every user and system that touches cardholder data. Enable MFA across all of them. This is one of the most critical PCI DSS v4.0 requirements and must be in place now.

Step 3: Update Your Password Policies

Review all password policies across your systems. Update minimum length to 12 characters. Communicate the change to all staff. Update any systems that do not support 12-character passwords as a priority.

Step 4: Implement Phishing Detection Tools

Deploy technical tools that automatically detect and block phishing attempts. Also update your security awareness training to include phishing and social engineering content. PCI DSS v4.0 requires both, not just one.

Step 5: Audit and Monitor Your Payment Page Scripts

If you have an online payment page, inventory every script that runs on it. Implement a monitoring system that alerts you the moment any script changes. This protects your customers from card skimming attacks and keeps you PCI DSS v4.0 compliant.

Step 6: Document Everything

PCI DSS v4.0 places heavy emphasis on documentation. Every security control, risk analysis and compliance decision must be recorded. If you use the Customised Approach, your documentation must prove your controls are as effective as the defined requirements.

Step 7: Engage a Qualified Security Assessor

A Qualified Security Assessor (QSA) can review your compliance posture and guide your remediation. This is especially important if you use the Customised Approach or handle high transaction volumes. Expert guidance saves time, reduces risk and gives you confidence before your next assessment.

How Cyber Security Risk Management Connects to PCI DSS v4.0

PCI DSS v4.0 is not just a payment standard anymore. It is a cyber security framework. The shift to continuous compliance means you need strong cyber security risk management built into your daily operations.

Australian and New Zealand businesses that already have mature cyber security solutions in place will find PCI DSS v4.0 much easier to implement. The controls overlap significantly, MFA, monitoring, phishing protection and encryption are all core cyber security practices.

If you are looking for cyber security company in NZ and Australia to help you build this foundation, choose a partner with specific PCI DSS advisory experience. Generic IT support is not enough. You need specialists who understand both the technical requirements and the compliance framework.

Security Solutions Hub offers PCI DSS advisory services specifically for Australian and New Zealand businesses. Their team can guide you from gap analysis through to full compliance, and help you build the ongoing security practices that PCI DSS v4.0 now demands.

Conclusion

PCI DSS v4.0 is not optional. It is not coming soon. It is already here and fully enforceable. Every business in Australia and New Zealand that takes card payments must meet these requirements now.

The good news is that the path forward is clear. Do the gap analysis. Enable MFA. Update your passwords. Monitor your payment pages. Document your controls. And get expert help to do it properly.

The cost of getting PCI DSS v4.0 wrong,  fines, lost payment rights, and legal liability is always higher than the cost of getting it right.

Need help with PCI DSS v4.0 compliance? Contact Security Solutions Hub today. Our PCI advisory team works with Australian and New Zealand businesses to achieve and maintain full compliance, without the complexity.

FAQs

Q1: Is PCI DSS v4.0 mandatory for small businesses in Australia?

Yes. Any business that stores, processes, or transmits cardholder data must comply, regardless of size. Small businesses that take card payments are subject to PCI DSS v4.0. The level of assessment required depends on your transaction volume, but the requirements apply to everyone.

Q2: What is the difference between PCI DSS v3.2.1 and v4.0?

PCI DSS v4.0 introduces 64 new or updated requirements compared to v3.2.1. The biggest changes are mandatory MFA for all CDE access, 12-character passwords, phishing protection requirements, payment page script monitoring, and a shift to continuous daily compliance rather than annual audits.

Q3: What happens if my business fails a PCI DSS v4.0 assessment?

Non-compliance can result in fines from card networks, increased transaction fees, mandatory forensic investigations, and, in serious cases, loss of your right to accept card payments. In Australia, a related data breach may also trigger obligations under the Privacy Act and the Notifiable Data Breaches scheme.

Q4: How long does it take to become PCI DSS v4.0 compliant?

It depends on your starting point. A business with basic security controls in place may take three to six months to reach full compliance. Businesses with larger or more complex card data environments may take longer. Starting with a gap analysis gives you a clear timeline and roadmap.

Q5: Where can I get PCI DSS v4.0 advisory help in Australia or New Zealand?

Security Solutions Hub provides specialist PCI DSS advisory services for Australian and New Zealand businesses. They can conduct gap analyses, guide remediation, and prepare your organization for formal assessment. Visit secsolutionshub.com to get started.

Conclusion: How Security Solutions Consulting Can Help

Achieving and maintaining PCI DSS compliance, particularly with the transition to v4.0 and its customised implementation options, requires precise scoping and specialist advisory. SSC’s PCI DSS advisors work with merchants, service providers, and acquirers across Australia, New Zealand, and APAC to scope engagements correctly, close gaps efficiently, and prepare organisations for QSA assessment.

GRCLens, GRCLens simplifies PCI DSS compliance management, mapping controls to v4.0 requirements, tracking remediation progress, and generating the continuous monitoring evidence required under the framework.

Ready to achieve PCI DSS compliance? Contact our team for a free, no-obligation consultation. We will assess your current position and provide a clear, prioritised roadmap tailored to your organisation.

Explore: PCI DSS Advisory | Security Compliance | Maturity Assessment | GRCLens Platform | Get in Touch