SideGuy · Compliance clarity · reviewed 2026-06-09
PCI 3.2.1 is retired — 4.0 (and the 4.0.1 refresh) is the standard now. The headline isn't 'a few new rules'; it's a shift in philosophy: from a rigid checklist to outcome-based security you can meet your own way. Here's what changed and what trips teams up.
| Dimension | PCI DSS 3.2.1 | PCI DSS 4.0 |
|---|---|---|
| Validation approach | Defined approach only — meet the requirement exactly as written | Adds a Customized Approach — meet the security objective your own way (with a targeted risk analysis) |
| Multi-factor auth | MFA for remote + admin access to the CDE | MFA for all access into the cardholder data environment |
| Risk analyses | Largely prescriptive frequencies | Targeted Risk Analyses let you justify frequencies — but you must document them |
| Passwords | 7 characters | 12 characters (or 8 if the system can't support 12), with stronger guidance |
| Scope & roles | Implicit | Explicit roles/responsibilities per requirement + clearer scoping documentation |
| Timeline | Retired (sunset March 2024) | Mandatory now; the future-dated requirements became effective March 31, 2025 |
Nothing — 3.2.1 is retired. If you're still validating against it, you're out of date and need to migrate to 4.0 now.
Everyone handling card data. Use the Defined Approach by default; reach for the Customized Approach only on specific requirements where your mature controls meet the objective differently.
No — 3.2.1 was retired (sunset March 2024). All assessments are against 4.0 / 4.0.1 now. If a vendor or QSA is still citing 3.2.1, that's a red flag.
New in 4.0: instead of meeting a requirement exactly as written (Defined Approach), you can meet its security objective with your own controls — but you must document a targeted risk analysis and the QSA must validate it. It's flexibility for mature teams, with a documentation cost.
A set of 4.0 requirements that were optional 'best practice' during the transition and became mandatory on March 31, 2025 — including expanded MFA, stronger passwords, and several targeted-risk-analysis items. They're all in force now.
Bigger than a version bump but not a rebuild — most controls carry over. The work is in the new items (all-access MFA, targeted risk analyses, documentation) and deciding where, if anywhere, to use the Customized Approach.
Written by PJ Zonis · SideGuy Solutions · operator-honest, vendor-neutral · Compliance hub