Topic starter
12/06/2026 10:25 pm
TL;DR: PCI DSS v4.0 adds 64 new requirements, mandates MFA for access to cardholder data environments, and expands risk assessment and third-party security expectations as organisations move from v3.2.1 to the new standard, according to Zluri. The compliance problem is less about new wording than about proving continuous access governance across human, NHI, and supplier-owned identities.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “PCI DSS v4.0: Exploring What's New in the Latest Version”.
By the numbers:
- PCI DSS v4.0 introduces 64 new requirements, some of which become mandatory by March 2025.
- The current version, PCI DSS v3.2.1, remained valid until March 31, 2024.
- If your organization handles payment card data, it must comply with v4.0 by March 31, 2025.
Key questions
Q: How should organisations use access reviews to support PCI DSS compliance?
A: Use access reviews to prove that only approved identities can reach cardholder data, and that revocation happens when access is no longer needed.
Q: Why do third-party identities create more PCI DSS v4.0 risk?
A: Third-party identities expand the compliance boundary because the organisation still owns the risk even when access is granted to vendors or connected services.
Q: What breaks when access reviews are only periodic in a PCI environment?
A: Periodic reviews miss access that becomes risky between audit cycles, especially for vendors, administrators, and cloud-based accounts.
Practitioner guidance
- Map cardholder-data access paths Identify every human, service, and third-party identity that can reach the cardholder data environment, then assign ownership for each access path.
- Automate recurring access reviews Use workflow automation to collect entitlement evidence, flag stale permissions, and push remediation for users and integrations on a fixed review cycle.
- Tighten third-party offboarding Remove supplier access when the business relationship ends, and verify that integrations, tokens, and delegated permissions are revoked as part of offboarding.
Bottom line: PCI DSS v4.0 raises the bar by tying compliance more tightly to continuous access governance, especially where third-party access can reach cardholder data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 1:10 am
PCI DSS v4.0 turns access governance into an evidence problem, not just a control problem: the standard’s emphasis on continuous monitoring, access reviews, and third-party security means organisations now have to prove that access is current, justified, and remediated. That aligns PCI compliance with modern identity governance practice, where the audit trail matters as much as the permission model. The practical conclusion is that access governance must be operationalised as an always-on discipline.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do when supplier access is no longer needed?
A: They should revoke the access, confirm that connected tokens or delegated permissions are disabled, and retain evidence that the offboarding action was completed. In PCI environments, leaving supplier access in place after need ends is a control failure, not an administrative delay.
👉 Read our full editorial: PCI DSS v4.0 raises the bar for access reviews and third-party risk
This post was modified 6 days ago by NHI Mgmt Group