Compliance
PCI DSS v4.0 Compliance for Payment Teams: What Changed and How to Reduce Scope
PCI DSS v4.0 became the only active version of the standard in March 2024. For payment teams that have been running on v3.2.1 assumptions, the transition involves more than updating a checklist. This guide covers the key changes in v4.0, how they affect enterprise payment infrastructure, and the most effective way to reduce your compliance scope: removing cardholder data from your own systems entirely.
What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) is the mandatory security framework for any organization that stores, processes, or transmits cardholder data. It is maintained by the PCI Security Standards Council and enforced through contracts with card networks (Visa, Mastercard, Amex, Discover).
Non-compliance can result in fines from acquirers, higher processing fees, and ultimately losing the ability to accept card payments. For enterprises, the cost of achieving and maintaining compliance is significant – full third-party audits (QSA assessments) typically cost €80,000–€250,000 per year.
What Changed in PCI DSS v4.0
Area | v3.2.1 | v4.0 |
|---|---|---|
MFA | Required for non-console admin access | Required for all access to the CDE |
Customised approach | Not available | Not available |
Targeted risk analysis | Prescriptive frequency requirements | Entities define frequency based on risk |
E-commerce / scripts | Limited requirements | New controls for all scripts on payment pages |
Phishing protection | Not explicitly required | Anti-phishing controls now required |
The Most Effective PCI Compliance Strategy: Scope Reduction
The most common mistake payment teams make with PCI DSS is trying to secure everything rather than removing sensitive data from their environment. Scope reduction – ensuring that cardholder data never enters your own systems in the first place – is the single highest-leverage action available.
The mechanism: a PCI DSS Level 1 certified vault stores cardholder data on your behalf. Your systems only ever handle tokens – non-sensitive references that are useless outside the vault's control environment. Because your infrastructure doesn't touch PANs, it is not in scope for the most demanding PCI requirements.
Approach | PCI Tier | Approx. Annual Cost |
|---|---|---|
Store PANs in-house | SAQ D / Full QSA | €80k–€250k+ |
Use PSP-bundled storage | SAQ A-EP | €20k–€60k |
Independent vault (Guardian) | SAQ A | €10k–€30k |
What v4.0 Means for Your Payment Infrastructure
Three areas require attention from most enterprise payment teams under v4.0:
• Payment page script controls (Req. 6.4.3): All scripts on your payment page must be authorized, have documented business justification, and their integrity must be verified. This affects teams using JavaScript-based hosted payment fields.
• MFA for all CDE access (Req. 8.4.2): If anyone on your team accesses systems in scope, they need MFA – not just admins. This includes read-only access to logs, reporting dashboards, or any system that touches cardholder data.
• Targeted risk analysis (Req. 12.3.2): You can now define your own control frequencies based on a documented risk analysis, rather than following prescriptive PCI schedules. This is more flexible but requires more documentation.
How Hellgate Supports PCI DSS v4.0 Compliance
Hellgate Guardian operates as a PCI DSS Level 1 certified service. Card data submitted to Guardian never enters the merchant's infrastructure – it flows directly into a certified cardholder data environment operated by Hellgate. Merchants receive a token and inherit the compliance posture of the vault.
This means merchants can typically qualify for SAQ A – the lightest PCI compliance pathway – rather than undergoing full QSA audits. Guardian also supports the v4.0 script integrity requirements through its hosted payment field implementation, and provides the audit trail documentation required under the new targeted risk analysis approach.
→ Hellgate Trustcenter and compliance documentation
→ See also: Cardholder Data Environment · PCI Vaulting [link: /glossary/pci-vaulting] · Scope Reduction [link: /glossary/scope-reduction]
Jens Kohnen was driven to co-start the company by the conviction that payment infrastructure should empower businesses, not bind them. Recognizing that many large organizations were locked into monolithic, opaque setups, Jens embarked on a journey to free enterprises from these rigid stacks. His mission is to enable companies to regain full ownership and monetize their flows, transforming payments from a cost center into a strategic lever for growth.
