PCI DSS v4.0.1 Explained: What Merchants and SaaS Companies Need to Do

What PCI DSS is

PCI DSS is a set of security requirements published by the PCI Security Standards Council. It protects cardholder data (the primary account number, cardholder name, expiration date, and service code) and sensitive authentication data (such as card verification codes and PINs). It is organized into twelve requirements grouped under six control objectives, and it is not a law. Card brands and acquiring banks enforce it through contracts.

Who it applies to

PCI DSS applies to any organization that stores, processes, or transmits cardholder data. It also applies to service providers whose systems could affect the security of that data. For SaaS companies, this often means a platform that hosts a payment flow, runs a checkout integration, or stores tokens tied to card transactions, even if the company never sees a full card number.

Scope is the biggest lever

Everything inside the cardholder data environment (CDE) is in scope, and scope drives cost. Three approaches usually reduce it:

• Tokenization, so systems store a token instead of the card number
• Hosted payment pages or iframes, so card data is captured by the payment provider rather than your servers
• Network segmentation, which keeps other systems out of scope, but must be tested to prove it works

Map where card data enters, moves, and is stored before you choose a validation path. Most scope surprises come from logs, support tools, and data exports that quietly contain card numbers.

Validation: SAQ or ROC

How you prove compliance depends on your transaction volume and how you accept payments. Smaller merchants usually complete a Self-Assessment Questionnaire (SAQ) matched to their payment channel. Larger organizations, and service providers above certain thresholds, typically need a Report on Compliance (ROC) prepared by a Qualified Security Assessor (QSA), with an Attestation of Compliance (AOC) summarizing the result. Confirm your level with your acquirer.

v4.0 requirements that catch companies off guard

Several v4.0 requirements were future-dated and became mandatory in March 2025. The ones that most often generate findings include:

• Script management on payment pages: an inventory of scripts loaded on checkout pages, with integrity controls
• MFA for all access into the CDE, not only remote access
• Targeted risk analyses where the standard allows flexibility in frequency
• Automated log review and retention controls

Recurring obligations

• Quarterly external vulnerability scans by an Approved Scanning Vendor (ASV)
• Internal scans and rescans after significant changes
• Penetration testing at least annually and after significant changes
• An annual review of your service providers' PCI compliance status