Payment page scripts (6.4.3 and 11.6.1)
Inventory, authorise and justify every script on payment pages, and detect unauthorised changes to page content and security headers.
PCI DSS v4.0.1 · QSA Company
PCI DSS v4.0.1 assessment from an accredited QSA Company.
SecuriCentrix is a PCI SSC-accredited Qualified Security Assessor Company. We help merchants and service providers in Ireland, South Africa and beyond scope, prepare for and validate PCI DSS v4.0.1 compliance, and stay compliant between assessments.
At a glance
Where PCI DSS stands today.
PCI DSS v4.0.1 is the current version of the standard. Version 3.2.1 was retired on 31 March 2024, and the future-dated requirements introduced in v4.0 became mandatory on 31 March 2025. Assessments now test the full set of v4.x requirements.
In June 2026 the PCI Security Standards Council opened a request for comments on PCI DSS. Until a new version is published and an effective date is set, v4.0.1 remains the version to assess against.
| Current version | PCI DSS v4.0.1 |
|---|---|
| Owner | PCI Security Standards Council |
| Future-dated requirements | Mandatory since 31 March 2025 |
| Validation | Report on Compliance (ROC) by a QSA, or Self-Assessment Questionnaire (SAQ), with an Attestation of Compliance |
| Scanning | Quarterly external scans by an Approved Scanning Vendor (ASV) |
| Testing | Internal and external penetration tests at least every 12 months and after significant change |
Scope
Who PCI DSS applies to.
PCI DSS applies to any organisation that stores, processes or transmits payment card account data, and to service providers that can affect the security of that data. Your validation route depends on your merchant or service-provider level and on the requirements of your acquirer and the card brands.
- Retail, hospitality and e-commerce merchants
- Payment service providers, processors, gateways and acquirers
- Fintechs, wallets and digital financial-services providers
- Hosting, cloud, managed service and call-centre providers within a client's cardholder data environment
Requirements
Requirements that need the most attention.
PCI DSS has 12 principal requirements. These v4.x requirements, mandatory since 31 March 2025, are where we most often see gaps.
MFA into the CDE (8.4.2)
Multi-factor authentication for all access into the cardholder data environment, not only remote and administrative access.
Passwords and accounts (8.3.6, 7.2.4)
Minimum 12-character passwords where passwords are used, and user account and access reviews at least every six months.
Targeted risk analysis (12.3.1)
Documented risk analyses that justify the frequency of controls where the standard allows flexibility.
Automated log review (10.4.1.1)
Automated mechanisms to perform audit log reviews, replacing manual sampling.
Phishing and awareness (5.4.1, 12.6.3.1)
Technical anti-phishing controls and security awareness that covers phishing and social engineering.
Vulnerability management (11.3.1.1, 11.3.1.2)
Authenticated internal vulnerability scanning, and managing all vulnerabilities, not only high and critical ones.
Scope confirmation (12.5.2, 12.5.2.1)
Document and confirm scope at least annually, and every six months for service providers.
Common gaps
Common PCI DSS gaps.
- Scope drawn from network diagrams rather than confirmed by data discovery and flow mapping
- No inventory or change detection for scripts on e-commerce payment pages
- MFA applied to remote access but not to all access into the CDE
- Segmentation controls assumed rather than tested at the required frequency
- Evidence assembled just before the assessment instead of collected while controls operate
- Third-party service provider responsibilities not documented in a responsibility matrix
Free checklist
PCI DSS v4.0.1 Readiness Checklist
A practical checklist covering scope, the formerly future-dated v4.x requirements, testing and scanning cadence, evidence and third-party responsibilities.
FAQs
PCI DSS questions we hear most often
Is SecuriCentrix a QSA Company?
Yes. SecuriCentrix is a PCI Security Standards Council-accredited Qualified Security Assessor Company, so we can perform formal PCI DSS assessments and issue Reports on Compliance.
Which version of PCI DSS should we assess against?
PCI DSS v4.0.1. Version 3.2.1 was retired on 31 March 2024, and all future-dated v4.x requirements have been mandatory since 31 March 2025.
Do we need a ROC or an SAQ?
It depends on your merchant or service-provider level and on what your acquirer or the card brands require. We can help you confirm the right validation route during scoping.
How often do we need penetration testing and scanning?
Internal and external penetration tests at least every 12 months and after significant change, quarterly external ASV scans and quarterly internal scans. Segmentation testing is annual for merchants and every six months for service providers.
Can P2PE reduce our PCI DSS scope?
Yes. A validated PCI P2PE solution can significantly reduce merchant scope and may allow use of the shorter SAQ P2PE. Read our PCI DSS and P2PE readiness checklist.
Related services and guidance
Sources
- PCI Security Standards Council: PCI DSS
- PCI SSC: Just Published, PCI DSS v4.0.1
- PCI SSC Document Library
- PCI Perspectives blog
This page is general guidance, not legal advice. Last reviewed 27 October 2026.