PCI-DSS 4.0 fully replaced 3.2.1 in March 2024, with the most-onerous new controls becoming mandatory in March 2025. UK retailers, hospitality groups, and payment-handling businesses have spent 2025 catching up. This is the practical survival guide for organisations still working through the requirements.
What changed in 4.0 vs 3.2.1
64 new or modified requirements vs 3.2.1. Most-material in 12 areas.
Customised approach option — alongside defined approach, organisations can demonstrate compliance via risk-based alternatives subject to QSA review.
Targeted risk analysis — required for many requirements (frequency of activity, choice of control, etc.).
Continuous scope review — annual scope confirmation no longer sufficient.
The 8 most-painful new controls
- •12.5.2 Continuous scope review
- •6.4.3 Inventory of payment page scripts + integrity monitoring
- •11.6.1 Tamper detection on payment pages
- •8.4.2 MFA on all access into CDE
- •8.6.1-3 Stricter password / authentication requirements for application accounts
- •11.3.1.1 Internal vulnerability scans must scan authenticated
- •11.3.2.1 External vulnerability scans must use ASV
- •12.6.2 Security awareness training tailored to job role
Practical UK retailer implementation
Scope reduction first. Tokenisation + P2PE devices push most of the store estate out of CDE scope. See our Retail + Hospitality IT practice.
Segmentation — store POS VLAN strictly separated from corporate. Firewall ACLs documented + tested quarterly.
Payment page script monitoring — SRI hashes + integrity tools (Akamai Page Integrity Manager, Reflectiz, others). New requirement that catches most retailers.
MFA — all admin access into CDE, all access from outside CDE, all SaaS admin consoles.
What Servnet does
Servnet supports UK retailers through PCI-DSS 4.0 readiness — segmentation design, tokenisation deployment, payment-page integrity tooling, MFA rollout, evidence preparation for QSA assessment.