What changed with 4.0.1
The Payment Card Industry Data Security Standard is maintained by the PCI Security Standards Council. Version 4.0.1, published in 2024, replaced 4.0 at the end of that year, and the requirements that were dated for the future became mandatory on 31 March 2025. They include stronger multi-factor authentication, targeted risk analyses, and protection against scripts that skim payment pages. The standard still has twelve requirements, from network security and secure configuration through encryption, vulnerability management, access control, logging and testing to security policies.
Scope first
A merchant or payment company must keep a list of its third-party service providers, know which PCI DSS requirements each one is responsible for, and monitor their compliance every year. So the first question is whether you store, process or transmit cardholder data, or could affect the security of the environment where it is. The answers then follow from that:
- You handle card data. Expect to provide an AOC from a qualified assessor or a self-assessment, a responsibility matrix showing which requirements you cover and which stay with the customer, and answers to detailed questions per requirement.
- You could affect the card environment (for example, you host the customer's checkout page or have network access to it). You are in scope for the requirements that touch that connection, and the customer will ask about them.
- You are outside it. Say so with the reasoning, and answer the general security questions like any other questionnaire.
What the questions look like
Beyond scope: whether you have a current AOC and from whom, the responsibility matrix, how you segment systems that handle card data, multi-factor authentication for all access into the card environment, vulnerability scanning by an approved scanning vendor, penetration testing, log retention, and how you would tell the customer about an incident affecting card data.
Answering as a vendor
Write the scope statement once, with a simple data flow, and agree it with whoever signs your contracts. If you are in scope, the responsibility matrix is the document reviewers want most; publish it with the AOC every year. If you are not, a clear paragraph explaining why saves a dozen follow-up questions.
In Responsemate
The scope statement, the AOC and the responsibility matrix sit in the knowledge base as evidence with their expiry dates, and every PCI row is drafted from them in the customer's words. What evidence to attach.
Questions people ask
Do we need to be PCI DSS compliant if we never touch card data?
Usually not, but you have to show it. Describe how card data flows around your service, confirm in writing that you do not store, process or transmit it, and say whether your service could still affect the security of the customer's card environment.
What is an AOC?
The Attestation of Compliance, the short document that states a company's PCI DSS assessment result. A service provider that is in scope is expected to give its customers a current AOC every year.