How to prepare for PCI DSS v4 in 2022

Discussion of PCI DSS v4 became prominent with the first request for comments (RFC) in 2019, and has continued since then.

PCI DSS v3.2.1 will not be retired until the first quarter of 2024. The PCI Security Standards Council will release v4 in the first quarter of 2022, probably close to or even on 31 March 2022. The public will not know what v4 contains until its release.

QSAs, Participating Organisations (POs) and Approved Scanning Vendors (ASVs) will be able to preview v4 shortly after New Year. As with everything so far, everyone is under an NDA regarding v4, so until it is public, information will be limited to whatever the Council shares through its blog.

Finally, future-dated requirements will not be enforced until the first quarter of 2025, giving organisations ample time — three years — to implement them.

Advice for merchants

Merchants should have the easiest transition to v4. After all these years, and the emergence of P2PE/E2EE and tokenisation solutions, they should no longer have sensitive authentication data (SAD) or cardholder data (CHD) in their environments. As a result, v4 should have only a minor impact on merchants, potentially introducing some new requirements to ensure CHD is no longer present.

Merchants have no valid business reason to keep SAD/CHD in their environments. Now is the time to remove it: if you think PCI DSS 3.2.1 is difficult, v4 will be even more challenging. Keeping SAD/CHD will make a PCI assessment harder under v4 and could expose the organisation as non-compliant rather than secure. Now is the time to move towards P2PE/E2EE and tokenisation solutions over the next three years.

Advice for service providers

There is little good news for service providers, because they are connected with processing, storing or transmitting SAD/CHD, or have access that can affect the security of those activities. One positive point is that, for the most part, the new version appears to have only a minimal immediate impact; the main concern is its future-dated requirements.

Remember that there are two types of service provider: those directly processing, storing or transmitting SAD/CHD, and those that can only affect its security. These distinctions matter because of the risk to SAD/CHD. Providers that could affect its security generally pose a lower risk than those directly processing, storing or transmitting it.

Service providers that only affect the security of SAD/CHD will need to assess their organisations' PCI DSS compliance. Many providers in this category still do not assess their PCI compliance.
They avoid it because organisations and QSAs do not ask for a PCI Attestation of Compliance (AOC), or offer the usual poor excuses for not having one or not needing it. Recent supply-chain attacks have changed this, and v4 addresses the issue by pressuring merchants and service providers to understand their providers' supply chains. That pressure will help ensure service providers demonstrate PCI compliance by obtaining their AOC. Providers in this category should therefore be ready for customers to demand compliance or change suppliers. Nor should they be surprised if customers send their QSAs to assess the organisation.

The service providers facing the full set of changes are those interacting directly with SAD/CHD. The good news is that the transition gives you at least three years for the future-dated requirements. Most immediate changes concern activities you already perform, with the Council changing their frequency. However, those future requirements concern QSAs most, because they remember how many organisations responded to the changes from v2 to v3 and even from v3.1 to v3.2. Organisations delayed starting projects and then encountered further delays, causing compliance problems a year or two later. To avoid this happening again, we encourage organisations to read v4 when it is released and determine the changes needed as soon as possible, avoiding the non-compliance issues of earlier transitions.