Is PCI DSS v4.0.1 mandatory in 2027?

Yes, PCI DSS v4.0.1 is the only active version of the standard, and all of its requirements, including the former future-dated items, apply to 2027 assessments.

When will the next version of PCI DSS be released?

The PCI SSC has not announced a release date. The Council began gathering industry feedback through a request for comments in mid-2026, which marks an early stage of development.

How often must PCI DSS scope be confirmed?

Merchants must confirm scope at least once every 12 months and after significant changes. Service providers must confirm scope at least once every six months.

What is a targeted risk analysis in PCI DSS?

A targeted risk analysis is a documented assessment, required by Requirement 12.3.1, that justifies how often an organization performs a control when the standard allows flexible frequency.

What evidence do QSAs expect for Requirement 11.6.1?

QSAs expect proof that the change and tamper detection mechanism ran at the defined frequency, that alerts were generated, and that personnel investigated and resolved each alert.

PCI DSS in 2027: Staying Audit-Ready Under v4.0.1

The CISO of a mid-sized payment service provider walked into a PCI DSS reassessment confident that every v4.0 gap had been closed. Policies were approved, script monitoring was running, and multi-factor authentication covered the cardholder data environment. In the first week of fieldwork, the Qualified Security Assessor asked for six months of alert review records from that monitoring tool, along with the targeted risk analysis that justified its review frequency. Neither existed in a form the assessor could accept, and the Report on Compliance slipped by nine weeks.

Our assessment team sees versions of this scenario across fintech, banking, airline, and BPO environments. The gap between deploying a control and proving that it operates is where most PCI DSS programs struggle as they plan for 2027.

Grace periods have ended, and assessors now test sustained performance across the full assessment period. This guide explains where the standard stands, which requirements draw the most scrutiny, and how security and governance leaders can stay audit-ready without a year-end scramble.

What Is The Current Status Of PCI DSS v4.0.1 Heading Into 2027?

PCI DSS v4.0.1 is the only active version of the standard, and it will remain the basis for every PCI DSS assessment conducted in 2027. The PCI Security Standards Council (PCI SSC) published v4.0.1 in June 2024 as a limited revision that corrected errors and clarified intent without adding new requirements.

Three dates define the current compliance position:

March 31, 2024: PCI DSS v3.2.1 was retired, leaving v4.0 as the active standard.
December 31, 2024: PCI DSS v4.0 was retired, and v4.0.1 became the sole version for assessments.
March 31, 2025: The 51 future-dated requirements, out of 64 new requirements introduced in v4.0, became mandatory, as the PCI SSC confirmed in its guidance on future-dated requirements.

For 2027, every requirement counts toward the compliance outcome, and none can be treated as a best practice. Many organizations are entering their second or third fully mandatory assessment cycle, where assessors compare current evidence against the previous report and expect controls to show maturity over time.

Which PCI DSS Requirements Do QSAs Scrutinize Most In 2027 Assessments?

QSAs focus most closely on the formerly future-dated requirements, because those controls now have enough operating history to test for consistency across the assessment period. The requirements that generate the most evidence requests in current assessments include:

Requirement 6.4.3: An inventory of all payment page scripts, with written justification, authorization, and integrity checks for each script.
Requirement 11.6.1: A change and tamper detection mechanism for payment pages and HTTP headers, with records showing that alerts were reviewed.
Requirement 8.4.2: Multi-factor authentication for all access into the cardholder data environment, including administrative and console access. Our guide to building a compliant MFA and password policy under PCI DSS Requirement 8 covers the design decisions in detail.
Requirement 10.4.1.1: Automated mechanisms for audit log review, which replace manual sampling. Our article on PCI DSS logging and monitoring requirements explains how to build an audit trail that passes testing.
Requirement 12.3.1: A targeted risk analysis for every requirement that allows the organization to set its own control frequency.
Requirement 5.4.1: Automated mechanisms that detect and protect personnel against phishing attacks.

Why Do Organizations Still Fail PCI DSS Audits After The v4.0.1 Transition?

Organizations still fail PCI DSS audits because their controls exist on paper while the operating evidence across the assessment period is incomplete or inconsistent. Across our QSA engagements, five root causes appear repeatedly:

Evidence gaps: Teams deploy tools for script monitoring or log review but do not retain proof that someone reviewed and acted on the output.
Boilerplate risk analyses: Targeted risk analyses are copied from templates and do not reflect the organization’s own threats, assets, or control frequencies.
Unmanaged scope growth: New cloud workloads, APIs, and integrations enter the cardholder data environment without formal scope review. Applying proven techniques to reduce PCI DSS scope lowers both risk and assessment effort.
Compliance drift: Configurations, access rights, and firewall rules move away from their validated state between assessments. This pattern of compliance drift often surfaces only when assessors begin sampling.
Unclear service provider responsibilities: Responsibility matrices for third-party service providers are missing or outdated, leaving controls that neither party fully owns.

Each of these failures has the same underlying cause, which is a program designed around a single assessment date.

How Can Enterprises Stay Audit-Ready For PCI DSS Year-Round?

Enterprises stay audit-ready for PCI DSS by running compliance as a continuous operating program, with evidence collected on schedule and reviewed before the assessor asks for it. The following practices form a dependable foundation:

Build an evidence calendar: Map every requirement to its testing frequency, whether daily, weekly, quarterly, semiannual, or annual, and assign a named owner for each evidence item.
Automate evidence collection: Use continuous controls monitoring to capture configuration states, log review records, and access changes as they occur. GRC platforms such as Ampcus Cyber’s ComplyX GRACE centralize this evidence across multiple frameworks.
Confirm scope on a fixed schedule: Requirement 12.5.2 requires scope confirmation at least once every 12 months and after significant changes, and service providers must confirm scope every six months under Requirement 12.5.2.1.
Treat targeted risk analyses as living documents: Review each analysis at least annually and update it whenever threats, technologies, or business processes change.
Run an internal readiness review: Conduct a mock assessment 90 to 120 days before fieldwork, so remediation can finish before the assessment period closes.
Reuse evidence across frameworks: Map PCI DSS controls to ISO 27001, SOC 2, and NIST requirements to reduce duplicate collection and audit fatigue.

Working with an experienced PCI Qualified Security Assessor during the readiness phase helps teams validate evidence quality before formal testing begins.

Should Organizations Prepare Now For The Next Version Of PCI DSS?

Organizations should monitor the development of the next PCI DSS version while keeping their full attention on v4.0.1, because v4.0.1 governs every assessment in 2027. The PCI SSC opened a request for comments on PCI DSS v4.0.1 from June 3 to July 20, 2026, describing it as the start of the next iteration of the standard. The Council invited feedback on implementation experience and on support for future technology, including AI.

The Council has not announced a publication date. History suggests a long runway, since v3.2.1 remained valid for two years after v4.0 was published in March 2022. Strong v4.0.1 evidence practices will carry forward into any successor version, which makes current investment the best preparation for future change.

Ready for your 2027 assessment?

Partner with Ampcus Cyber’s QSA team for gap analysis, readiness, and certification through our PCI DSS compliance services