PCI DSS 4.0 / 4.0.1: technical controls for fintech and e-commerce in Latin America
PCI DSS v4.0.1 is the only active version of the standard since December 31, 2024, and the 51 deferred requirements became mandatory on March 31, 2025. If your company processes, transmits or stores card data in Latin America, the technical controls must be in place today.
Key dates for PCI DSS v4.0 and v4.0.1
Three milestones define the transition: the publication of v4.0 in 2022, the v4.0.1 revision in 2024, and March 31, 2025, the date all deferred requirements became mandatory.
March 2022
PCI Security Standards Council publishes PCI DSS v4.0 with 64 new requirements. The 51 marked as best practices have a deferred mandatory date of March 31, 2025.
March 31, 2024
PCI DSS v3.2.1 is retired. PCI DSS v4.0 becomes the only active version of the standard.
June 11, 2024
PCI DSS v4.0.1 is published, a limited revision that corrects wording and clarifies the scope of some requirements. It adds no new mandatory controls and removes none.
December 31, 2024
PCI DSS v4.0 is retired. PCI DSS v4.0.1 is from that date the only active version of the standard.
January 30, 2025
PCI SSC publishes an update to SAQ A: removes requirements 6.4.3 and 11.6.1 from the questionnaire and adds a new eligibility criterion for e-commerce merchants.
March 31, 2025
The 51 deferred requirements become mandatory. Every PCI DSS assessment from that date onward must consider them. They are not optional.
Technical requirements with the most impact on engineering
PCI DSS v4.0.1 introduces concrete technical controls over scripts, identity, logs and CDE scope.
| Requirement | What it requires | Typical technical control |
|---|---|---|
| 6.4.3 | Inventory, authorization and integrity of all scripts loaded on the consumer-facing payment page | Content Security Policy (CSP), Subresource Integrity (SRI), registry of third-party and fourth-party scripts |
| 11.6.1 | Detection of changes and tampering in HTTP headers and in the payment page as received by the browser | HTTP response monitoring, alerts on changes to the DOM or security headers |
| 8.4.2 | MFA for all non-console access to the CDE, in any role and location (in v3.2.1 it was required only for administrators) | TOTP, FIDO2 keys or WebAuthn; review of all systems with CDE access |
| 8.3.6 | Passwords of at least 12 characters with letters and numbers, or 8 if the system cannot support 12 | Policy updates in IdP, Active Directory and CDE authentication systems |
| 5.4.1 | Automated mechanisms to detect and protect against phishing attacks | DMARC, SPF and DKIM on all domains; email filtering with alerts |
| 10.4.1.1 | Automated review of audit logs to detect anomalies; manual review is no longer sufficient | SIEM with detection rules and alerts on CDE access and changes |
| 12.5.2 | Documented confirmation of CDE scope at least once a year and after significant changes | Card data flow mapping, in-scope system inventory, segmentation review |
| 12.3.1 | Documented Targeted Risk Analysis for each requirement that allows flexibility in implementation or frequency | Documentation of specific risk, controls and review at least once every 12 months |
Sereno is not a QSA and does not issue PCI DSS compliance reports. We implement the technical controls and prepare the evidence alongside your QSA or internal compliance team.
SAQ A in e-commerce: what changed in 2025
SAQ A applies to merchants that fully outsource payment processing and do not store card data. In January 2025, the PCI SSC published an important update.
What was removed from SAQ A
Requirements 6.4.3 (script management), 11.6.1 (tampering detection) and 12.3.1 (risk analysis for 11.6.1) were removed from the SAQ A questionnaire. The PCI SSC clarified that this removal does not eliminate the underlying obligation within the standard.
New eligibility criterion
The updated SAQ A requires confirming that the merchant's site is not susceptible to script attacks that could affect its e-commerce system. Implementing the controls in 6.4.3 and 11.6.1 is one way to satisfy that criterion, according to guidance published by the PCI SSC in 2025.
Who remains required to comply
Payment service providers and merchants validating with SAQ A-EP, SAQ D or a ROC remain fully required to comply with 6.4.3 and 11.6.1.
Merchant levels (Level 1 through Level 4) and the obligation to use a QSA for an on-site assessment are defined by the card brands based on annual transaction volume. Check with your acquirer for the exact requirements for your level and brand.
How Sereno implements PCI DSS technical controls
Our team of senior engineers brings the standard's controls into your cloud infrastructure, Kubernetes and CI/CD, and prepares the evidence for your QSA.
Infrastructure audit
In two weeks: CDE mapping, network segmentation review, access, logs and security configuration. Read-only access. Report with gaps and priorities. From USD 3,000. See the audit.
Controls implementation
MFA for the entire CDE, password policies, CSP and SRI on payment pages, DMARC and SPF, SIEM with automated detection, network segmentation. The same type of work we do for SOC 2 and ISO 27001, at a fixed price based on scope.
24/7 platform and security team
Continuous operations: patching, secure CI/CD, secrets management with IaC, backups and DR, SOC-lite monitoring with open source tools, monthly report. From USD 8,000/month. See the monthly service.
Evidence for your QSA
We organize and document the technical evidence your QSA needs: configurations, logs, policies, change records and proof of each implemented control.
All our engineers have 10 or more years of experience. We start with read-only access, NDA, MFA and least privilege before making any change to your environment.
PCI DSS v4.0.1 technical checklist
Starting points for engineering teams beginning or updating their compliance program.
- Up-to-date inventory of all systems that store, process or transmit card data.
- Verified network segmentation between the CDE and the rest of the infrastructure.
- MFA active for all non-console CDE access, in all roles and locations.
- Password policy updated to a minimum of 12 alphanumeric characters on all CDE systems.
- CSP and SRI configured on all payment pages, with an inventory of third-party scripts (required except for merchants validating with SAQ A).
- HTTP header and payment page monitoring with automatic alerts on changes (required except for merchants validating with SAQ A).
- DMARC, SPF and DKIM configured and monitored on all company domains.
- SIEM or equivalent tool with automated CDE log review and anomaly alerts.
- Documented CDE scope confirmation completed within the last 12 months.
- Documented Targeted Risk Analysis for each requirement that allows flexibility in implementation.
- Incident response procedure tested with evidence from the most recent test.
Questions
What is PCI DSS v4.0.1 and how does it differ from v3.2.1?
PCI DSS (Payment Card Industry Data Security Standard) is the international standard that companies must comply with when they store, process or transmit payment card data. Version 4.0 was published in March 2022 and version 4.0.1 in June 2024, as a minor clarification revision. PCI DSS v4.0.1 is the only active version since December 31, 2024. Compared to v3.2.1, the main changes for engineering are: MFA required for all access to the CDE (not just administrators), script controls on payment pages (requirements 6.4.3 and 11.6.1), minimum 12-character passwords, automated log review, anti-phishing mechanisms and a formal targeted risk analysis approach.
When did the new PCI DSS v4.0 / v4.0.1 requirements become mandatory?
The 51 requirements that were marked as deferred best practices in 2022 became mandatory on March 31, 2025. Any PCI DSS assessment conducted from that date onward must consider them. PCI DSS v3.2.1 was retired on March 31, 2024.
Do requirements 6.4.3 and 11.6.1 apply to my e-commerce if I use a third-party payment processor (SAQ A)?
It depends on your situation. On January 30, 2025, the PCI SSC updated the SAQ A and removed requirements 6.4.3 and 11.6.1 from the questionnaire. Merchants validating with SAQ A no longer need to answer those requirements directly, but the updated SAQ A includes a new eligibility criterion: confirming that the site is not susceptible to script attacks that could affect its e-commerce system. The PCI SSC published guidance indicating that implementing the controls in 6.4.3 and 11.6.1 is one way to meet that criterion. If you are a payment service provider or validate with SAQ A-EP, SAQ D or a ROC, you remain fully required to comply with 6.4.3 and 11.6.1.
What is a QSA and when do I need one?
A QSA (Qualified Security Assessor) is an auditor certified by the PCI SSC to conduct on-site compliance assessments. Card brands (Visa, Mastercard and others) define merchant levels based on annual transaction volume: Level 1 merchants, generally those exceeding 6 million annual transactions according to Visa, and some Level 2 merchants require an on-site audit by a QSA. Level 3 and 4 merchants can generally self-assess using a SAQ. Check with your acquirer for the exact thresholds for your level and brand.
What is the Customized Approach in PCI DSS v4.0?
The Customized Approach is an option introduced in PCI DSS v4.0 that allows implementing alternative controls that meet a requirement's objective in a different way from the default-defined controls (Defined Approach). To use it, you must perform a Targeted Risk Analysis for each requirement, document the alternative control design, obtain senior management approval and have the control assessed by a QSA. It is relevant for fintechs with innovative architectures, but it adds significant documentation overhead.
What does Sereno do in a PCI DSS project, and what does it not do?
Sereno implements the standard's technical controls in your infrastructure: MFA, network segmentation, CSP and SRI on payment pages, SIEM, secrets management, and organizes the technical evidence for your assessment process. We start with a two-week infrastructure audit with read-only access. Sereno is not a QSA and does not issue PCI DSS reports or certifications. We do not replace your compliance team or your auditor: we work alongside them.
Sources
Last reviewed: November 9, 2026. Standards change: always check the current official text.
- PCI DSS v4.0.1: Just Published (PCI SSC Blog)
- Important Updates Announced for Merchants Validating to SAQ A (PCI SSC Blog)
- New Information Supplement: Payment Page Security and Preventing E-Skimming (PCI SSC Blog)
- Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x (PCI SSC Blog)
- PCI DSS v4.0 At A Glance (PCI SSC)
- Is the Customized Approach Right for Your Organization? (PCI SSC Blog)
- Guidance for PCI DSS E-commerce Requirements Effective After 31 March 2025 (PCI SSC Podcast)
Let's talk for 20 minutes
Pick a time in the calendar. It’s a 20-minute Google Meet call, and all we want is to understand your context.
Or write to hola@serenoops.com