PCI-DSS v4.0: what actually changed

PCI-DSS v4.0 became mandatory in March 2024 (v3.2.1 retired) with several requirements deferred to March 2025. The customized approach and multi-factor authentication expansion got most of the coverage. Less discussed are several requirements that shift how integrations should be designed.

Written August 2026 from a mix of implementation reviews.

The less-covered changes

• Requirement 6.4.3 — mandatory client-side script inventory. Every script running on a payment page must be inventoried and monitored for integrity. This affects checkout pages more than the terminal side, but any web-based payment flow needs to review it.
• Requirement 8.3.6 — password strength for accounts with access to cardholder data. The old minimum is gone; the new standard requires either 12+ character passwords or multi-factor authentication for anything touching CHD.
• Requirement 11.6 — payment page anti-tampering. Any change to the sensitive elements of a payment page must be detected. This is nontrivial to implement well; a naive checksum is not enough.

What integrations should audit

• Every third-party script on a checkout page. If you don't have an inventory, you don't have a compliant page.
• Every service account with database access. The MFA requirement extends to automated systems in some interpretations; verify with your QSA.
• The change-detection mechanism on your payment page. Is it monitoring what actually matters? A tag manager that can inject arbitrary scripts is the entire attack surface in one component.

The compliance-vs-security distinction

Being compliant with 4.0 is not the same as being secure. A merchant can pass an assessment with a tag-manager configuration that would fail any competent penetration test. Compliance is a floor. Where teams spend time above the floor is what matters.