PCI DSS

1. 2026-09-28 Medium
   PCI SSC publishes Secure Software Lifecycle Standard v2.0

   The PCI Security Standards Council has published version 2.0 of the PCI Secure Software Lifecycle (Secure SLC) Standard, representing the first major revision. This update affects …

   New version Action required

2. 2026-09-15 Low
   PCI SSC publishes Security Considerations for AI Systems information supplement

   The PCI Security Standards Council has published a new information supplement addressing security considerations for artificial intelligence systems. The document covers both the security aspects of …

   New document

3. 2026-09-14 Medium
   PCI SSC publishes Key Management and Operations Standard v1.0

   The PCI Security Standards Council has published the new PCI Key Management and Operations (KMO)™ Standard v1.0, establishing security and test requirements for entities managing cryptographic …

   New document Action required

That is the last 90 days. Sign in to read further back.

1. 2026-07-20 Request for comments on PCI DSS v4.0.1 closes. It opened on 3 June 2026 and starts work on the next version of the standard. No publication date has been announced.
2. 2025-03-31 New v4.0 requirements that were best practices until this date become mandatory
3. 2025-01-30 SAQ A r1: requirements 6.4.3, 11.6.1 and 12.3.1 removed. A new eligibility criterion added instead: the merchant confirms its site is not susceptible to script attacks.
4. 2024-12-31 PCI DSS v4.0 retired; v4.0.1 becomes the only active version

1. 2024-06-11
   v4.0.1 RevisionCurrent

   Limited revision: fixes formatting and typos and clarifies intent; no requirements added or deleted. source

   More

   • Patching within 30 days again applies only to critical vulnerabilities.
   • MFA for non-administrative access into the CDE is not needed for accounts that use only phishing-resistant authentication.
   • Notes for issuers, payment-page scripts and third-party service providers were clarified.
2. 2022-09-30
   v3.2.1 r1 Errata source

   Not confirmed by an official source yet.

3. 2022-03-31
   v4.0 Major version

   Replaced v3.2.1. source

   More

   • Firewall wording became "network security controls" and multi-factor authentication (MFA) is required for all access into the CDE.
   • Organizations got more flexibility to meet security objectives in different ways, and targeted risk analyses let them set how often some activities are performed.
   • v3.2.1 stayed active for two years.
4. 2018-05-17
   v3.2.1 Revision source

   Not confirmed by an official source yet.

5. 2016-04-28
   v3.2 Revision

   Replaced v3.1 to address growing threats to customer payment information. source

PCI DSS covers every entity involved in payment card processing that stores, processes or transmits cardholder data or sensitive authentication data.

Also covers

Any entity that could affect the security of the CDE. source

Includes

Merchants of every size, processors, acquirers, issuers and service providers. source

Who decides

PCI SSC does not decide who must comply or validate. That is up to the organisations that run compliance programmes: payment brands, acquirers and others. source

Visa

Visa requires PCI DSS compliance of all entities that store, process or transmit Visa cardholder data. source

Either a Qualified Security Assessor (QSA) or a Self-Assessment Questionnaire (SAQ), required by the acquirer or payment brand.

Self-assessment

Merchants and service providers that their acquirer or payment brand does not require to submit a Report on Compliance (ROC) self-assess. source

Questionnaire

They use the Self-Assessment Questionnaire (SAQ) that fits their environment (A, A-EP, B, B-IP, C, C-VT, D, P2PE or SPoC), and SAQ D is the only SAQ for service providers. source

Assessor

The others are assessed by a Qualified Security Assessor (QSA), an independent firm qualified by PCI SSC, who documents the result in a ROC. source source

Attestation

Either way, an Attestation of Compliance (AOC) is attached. source source

Scans

Quarterly external scans by an Approved Scanning Vendor (ASV) may also be required. source source

How often

PCI SSC says the brands and acquirers, not the standard, set how long a result stays valid and how often to reassess. source

Visa

Visa requires service providers to demonstrate compliance at least every 12 months. source

Scope confirmation

The standard itself requires an annual confirmation of scope (requirement 12.5.2). source source

PCI DSS is an industry standard enforced through contracts, and PCI SSC imposes no penalties.

Payment brands

Each participating payment brand runs its own enforcement programme and decides who must validate, at what level, and what fines or penalties apply. source

Visa

Under the Visa Core Rules, if a merchant or service provider is not compliant, Visa may levy a non-compliance assessment on the issuer or acquirer. source

Who pays

The issuer or acquirer must pay it and may not present it to the merchant as a Visa-imposed penalty. source

Waiver

Visa may waive the assessment if a forensic investigation shows no non-compliance before and at the time of a breach. source

1. Standard PCI DSS v4.0.1 (standard; download requires accepting the PCI SSC licence form)
2. Guidance Summary of Changes from PCI DSS v4.0 to v4.0.1 (licence form)
3. Guidance PCI DSS v4.x Quick Reference Guide (January 2025)
4. Guidance SAQ Instructions and Guidelines v4.0.1 r1 (April 2025)
5. Template SAQ A v4.0.1 r1 (January 2025)

1. SWIFT CSCF

   SWIFT CSCF secures banks' SWIFT messaging infrastructure and is attested to SWIFT. PCI DSS secures payment card data and is validated to card brands and acquirers.

2. SOC 2

   A SOC 2 report is an auditor's opinion on controls a company picks against the AICPA Trust Services Criteria. PCI DSS is a fixed set of card-data requirements that the card brands demand, so a SOC 2 report does not replace a ROC or SAQ.

3. ISO 27001

   ISO 27001 certifies a whole information security management system with a scope the company chooses. PCI DSS prescribes specific technical controls for the CDE only.

4. NIST CSF

   NIST CSF is a voluntary set of outcomes for any organisation. PCI DSS is a mandatory, testable standard for card data, and PCI SSC publishes a mapping of v4.0.1 to CSF 2.0.

Verified against official sources on 17 October 2026. We monitor the official sources for this framework. Watching since 7 September 2026. Subscribe to PCI DSS (RSS)