Question 1

What changed with PCI DSS v4.0.1?

Accepted Answer

Version 4.0.1 made the prior v4.0 the only valid standard once v3.2.1 retired, and a batch of future-dated requirements became mandatory in March 2025. Those include targeted risk analyses, stronger authentication, and client-side script monitoring for payment pages, which is where most teams found fresh remediation work and unplanned spend.

Question 2

Do we need a QSA or can we self-assess?

Accepted Answer

It depends on your transaction volume and acquirer requirements. Most smaller merchants self-assess with a SAQ, while Level 1 merchants and many service providers must engage a Qualified Security Assessor for a Report on Compliance. Your acquiring bank and the card brands set the threshold, so confirm with them before scoping.

How much does PCI DSS compliance cost in 2026?