In our last discussion, we explored the evolution of Requirement 1 in the transition from PCI DSS v3.2.1 to v4.0, with a particular emphasis on the move towards ‘network security controls’. As we continue our exploration of the updated PCI DSS v4.0, today’s focus will be on the transformations in Requirement 2.

As we all know, data security is a constantly evolving field, and it’s essential to keep up with the latest standards and requirements. And mark your calendars, because the current PCI DSS v3.2.1 is set to retire on March 31st, 2024. That’s right, the PCI Security Standards Council (SSC) has announced the release of the new and improved PCI DSS v4.0, and compliance with this updated version is mandatory for organizations to maintain data security.

In the world of digital transactions, businesses handling payment cards must demonstrate their data security measures through the Payment Card Industry Self-Assessment Questionnaire (PCI SAQ). Completing the SAQ is a key step in the PCI DSS assessment process, followed by an Attestation of Compliance (AoC) to confirm accuracy. Level 1 merchants and service providers, mandated by PCI SSC or customers, must complete a Report on Compliance (RoC), while others use an SAQ.