Probably one of the most frequent questions we get at the moment is around when Version 4 of
the PCI DSS will be released. It’s the question that’s on everyone’s mind because a new
version of the Standard usually means changes to the requirements that people need to
address.

While there’s not a lot that we can say about Version 4 at the moment, there are a few things
that we can talk about because they have been made public by the PCI SSC.

When Will Version 4 Come Out?

The PCI SSC announced in May 2020 that Version 4 is expected to be completed (and
hopefully released) in Quarter 2 of 2021.

Update: In February 2021, the PCI SSC announced that there would be a third RFC (request f
or comments) focusing on the supporting documents including the Report on Compliance
(ROC) template, Self-Assessment Questionnaires (SAQs), and Attestation of Compliance (AoC)
documents. They are targeting a Q4 completion date for PCI DSS v4.0. Further updates will be
provided when available. 

When Do I Have to Use Version
4?

You can start using Version 4 as soon as it’s released if you’d like. Reasons why you might
want to start using Version 4 before it’s required may include:

• Taking advantage of new requirements that may better match your organisational
  processes.
• Taking early steps to ensure that by the time Version 4 is enforced for reporting that you’re
  not left unprepared and facing an extended period of remediation.
• Working to meet requirements early and improving your overall security posture.

There may be other reasons why you want to start using Version 4 earlier too.

But of course, if you want to wait until the last minute, the PCI SSC expects to retire Version
3.2.1 in Q2 of 2023 (pretty much two whole years after Version 4 is released).

With previous versions of PCI, we saw that there was usually a one-year transition period. But
what this two-year transition period should tell you is that you should be expecting some major
changes. In early PCI SSC posts, they indicated that there will be new requirements and a
change to objectives-based reporting.

Can I Avoid Changing
Passwords If I Use Version 4?

We will have to wait and see, but the PCI SSC did say that there are “proposed revisions to
requirements on passwords to accommodate different authentication options”. So we will just
have to wait and see what’s in the final version of the Standard that is released.

Do I Have to Meet Every PCI
Requirement Once Version 4 is
Required for Reporting?

There are likely to be additional requirements which don’t immediately come into full force at
the same time that Version 4 is released. In fact, the PCI SSC has said that certain new v4
requirements will not become effective until Q1 2024. So that’s nearly four years from when this
post was originally written.

So, What Do I Do Now?

For now, we are all just waiting to see what is in the final version of the Standard. Even though
as a QSA Company we are able to review the drafts and provide feedback, it’s not something
that we can discuss publicly. And any early drafts may change by the time the final version of
the Standard is released. So for now, we can all just wait to see.

As more information is made public we will post about it here, and once Version 4 is released,
you can expect posts about the new requirements and how they might be able to be addressed
in New Zealand. But just because Version 4 is around the corner, that doesn’t mean you should
delay looking at your PCI compliance. Confide can help you with your compliance journey. 
Contact us to find out more.