--- title: "PCI 4.0 in 2025: What best practices are becoming requirements?" description: Many PCI requirements will move from “best practice” to “required” in March 2025. This post discusses some of the most impactful new requirements. image: https://blog.basistheory.com/hubfs/2025%20PCI%20Requirement%20update.png --- [Skip to content](https://blog.basistheory.com/pci-requirements-in-2025#main-content) ![Basis Theory logo](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=365&height=122&name=BTLogo%20(1).png) - [Use Cases](https://basistheory.com/) Show submenu for Use Cases - [Creator Economy](https://basistheory.com/use-cases/creator-economy) - [Digital Health](https://basistheory.com/use-cases/health) - [E-Commerce](https://basistheory.com/use-cases/ecommerce) - [Fintech](https://basistheory.com/use-cases/fintech) - [Gaming](https://basistheory.com/use-cases/gaming) - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions) - [Travel](https://basistheory.com/use-cases/travel) - [VSaaS](https://basistheory.com/use-cases/vsaas) - Solutions Show submenu for Solutions - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce) - [Data Consolidation](https://basistheory.com/solution/data-consolidation) - [Monetize Payments](https://basistheory.com/solution/monetize-payments) - [Multi PSP](https://basistheory.com/solution/multi-psp) - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery) - [Payment Vault](https://basistheory.com/solution/payment-vault) - [Platform](https://basistheory.com/platform) Show submenu for Platform - [Enrichments & Add-Ons](https://basistheory.com/add-ons) - [Partners](https://basistheory.com/partnerships) - [Why Basis Theory](https://basistheory.com/why-basis-theory) - [Pricing](https://basistheory.com/pricing) - Resources Show submenu for Resources - [Blog](https://blog.basistheory.com) - [Case Studies](https://blog.basistheory.com/case-studies) - [Docs](https://developers.basistheory.com/) Open main navigation Close main navigation - [Use Cases](https://basistheory.com/) Show submenu for Use Cases - [Creator Economy](https://basistheory.com/use-cases/creator-economy) - [Digital Health](https://basistheory.com/use-cases/health) - [E-Commerce](https://basistheory.com/use-cases/ecommerce) - [Fintech](https://basistheory.com/use-cases/fintech) - [Gaming](https://basistheory.com/use-cases/gaming) - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions) - [Travel](https://basistheory.com/use-cases/travel) - [VSaaS](https://basistheory.com/use-cases/vsaas) - Solutions Show submenu for Solutions - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce) - [Data Consolidation](https://basistheory.com/solution/data-consolidation) - [Monetize Payments](https://basistheory.com/solution/monetize-payments) - [Multi PSP](https://basistheory.com/solution/multi-psp) - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery) - [Payment Vault](https://basistheory.com/solution/payment-vault) - [Platform](https://basistheory.com/platform) Show submenu for Platform - [Enrichments & Add-Ons](https://basistheory.com/add-ons) - [Partners](https://basistheory.com/partnerships) - [Why Basis Theory](https://basistheory.com/why-basis-theory) - [Pricing](https://basistheory.com/pricing) - Resources Show submenu for Resources - [Blog](https://blog.basistheory.com) - [Case Studies](https://blog.basistheory.com/case-studies) - [Docs](https://developers.basistheory.com/) - [Get a demo](https://basistheory.com/contact) [Login](https://portal.basistheory.com/) [Get a demo](https://basistheory.com/contact) November 6, 2024 ![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) · [Compliance](https://blog.basistheory.com/tag/compliance) [Payments](https://blog.basistheory.com/tag/payments) # PCI 4.0 in 2025: What best practices are becoming requirements? ![Preparing for PCI in 2025: What best practices are becoming requirements?](https://blog.basistheory.com/hubfs/2025%20PCI%20Requirement%20update.png)   - [Updates to PCI 4.0](https://blog.basistheory.com/pci-requirements-in-2025#Updates) - [Multi-Factor Authentication](https://blog.basistheory.com/pci-requirements-in-2025#MFA) - [Payment Page Script Security](https://blog.basistheory.com/pci-requirements-in-2025#Page) - [Enhanced Web Protection](https://blog.basistheory.com/pci-requirements-in-2025#Web) - [SAQ and ROC Updates](https://blog.basistheory.com/pci-requirements-in-2025#SAQ) As you read through the PCI [4.0](https://blog.basistheory.com/pci-4.0-updated-requirements-merchants) requirements and standards, several sections will say, “This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment.”  ![PCI requirement updates in 2025](https://blog.basistheory.com/hs-fs/hubfs/quote.png?width=3820&height=1904&name=quote.png)This deadline is approaching!  More than 50 requirements were future-dated to give organizations time to implement these changes, some of which can take up to 12 months. A complete summary of the changes from PCI DSS Version 3.2.1 to 4.0 can be [found in this document from the PCI Security Standards Council](https://docs-prv.pcisecuritystandards.org/PCI%20DSS/Standard/PCI-DSS-v3-2-1-to-v4-0-Summary-of-Changes-r2.pdf). The summary of new requirements will list all new requirements, the entity to which the new requirement applies, and the effective date of the new requirement.  We’ve called out a few of the most impactful updates below.  ![2025 PCI Compliance Key Updates](https://blog.basistheory.com/hubfs/2025%20PCI%20Compliance%20Key%20Updates.png) ## Multi-Factor Authentication  The new requirement is to implement multi-factor authentication (MFA) for all access into the cardholder data environment. This was a best practice and now applies to anyone storing PCI data. It also may require the most engineering effort. Implementing MFA is not the same as the other updates because it cannot be handled with a documentation or policy update. This is technical implementation work and is a high effort for most engineering teams. This requirement predominantly applies if you are storing cardholder data in-house. If you are vaulting card data with a PSP or other third-party, this update does not apply to you because there is no card data environment to secure, keeping the costs of PCI compliance much lower. In that case, the assumption is whoever the merchant is working with meets this standard of PCI compliance. However, it doesn’t hurt to check with those platforms to ensure they have MFA properly set up. [Return to Top](https://blog.basistheory.com/pci-requirements-in-2025#TOC) ## Payment Page Script Security  Arguably, the single biggest topic at the [PCI DSS North America Community Meeting in August](https://events.pcisecuritystandards.org/) was Payment Page Script Security (also known as Subresource Integrity or Payment Page Resource Integrity.)  Requirements 6.4 and 11.6 require a way to guarantee the authenticity and authorization of every third-party script enabled on the checkout page, plus a documented inventory and justification for every script. Each security team should be monitored and alerted if an unauthorized script is loaded into the checkout flow.   This update protects against web skimming, e-skimming, or [formjacking](https://blog.basistheory.com/pci-dss-formjacking-rules), techniques that hackers use to capture sensitive data from users on legitimate payment pages. Solutions that have been identified are nuanced and, in some cases, could be considered less than ideal: - **Remove all third-party libraries** that don’t serve a function within a checkout page. If it’s unrelated to the business process of collecting payment details, it shouldn’t be on the checkout page. If it’s there, it should be justified and documented.  - **Have a payment service provider** (**PSP**) or **token orchestration platform** completely host the payment page. This would be an entirely separate page to which the consumer would be routed, where they would enter their payment details. While not always ideal from a customer experience standpoint, most PSPs already offer this.  QSAs that we spoke with said the most straightforward way to address Payment Page Script Security is for the third-party to fully host the payment page for its customers.  [Return to Top](https://blog.basistheory.com/pci-requirements-in-2025#TOC) ## Enhanced Web Protection  See: 6.4.2, 6.4.3, 11.6.1. You will need a Web Application Firewall, or equivalent functionality, to detect and prevent web-based attacks. Additionally, you must implement a system to inventory, authorize, and justify changes to any scripts that execute in your customer's browser, particularly on your payments page. [Return to Top](https://blog.basistheory.com/pci-requirements-in-2025#TOC) ## SAQ and RoC Updates  Updates to the [SAQ and RoC](https://blog.basistheory.com/pci-dss-saq-self-assessment) templates that are intended to help complete the forms.  The expectation is that if you make a change in your environment (e.g., adding a new firewall), you need to do a risk assessment on that change. Formal risk assessments may not seem like a big change based on some of the other future-dated requirements that have been added to the standard, but this change may result in additional effort in the transition process. [Return to Top](https://blog.basistheory.com/pci-requirements-in-2025#TOC) ## Moving Forward  It can feel like the only thing harder than becoming [PCI compliant](https://blog.basistheory.com/12-pci-dss-requirements) is staying PCI compliant. If any of these updates come as a surprise to security teams—or were perhaps underestimated—not being fully implemented by March 31, 2025, means falling out of PCI compliance.  Merchants will work with providers like Basis Theory to reduce most of the PCI scope, making these changes significantly easier to comply with. [Why Basis Theory](https://basistheory.com/why-basis-theory)? [Return to Top](https://blog.basistheory.com/pci-requirements-in-2025#TOC) [![View an Interactive Demo   See how the Basis Theory platform secures payment data and significantly reduces PCI compliance burden from day 1.  ](https://no-cache.hubspot.com/cta/default/22332934/interactive-171495116167.png)](https://blog.basistheory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJmLdO8fFXZJ1NIC8QbnKFxKi4qOwYZNjx1JFe7KXYMIh9Hgm3mvVCSzMwNYCOtJEyQs9FDNQ1XACUvxnYFmmz0%2BNgazrrtNnp2yBuyVU32RhR2q8MHXHQqYYIH5%2FdSeov4qJeM44smlOPNfWCn16H0PyDWCuS%2FJZqqA201yGKbV3DoNv4F7TUG83awTPNZV3PPbrQ6fIxpNuN474JrQjHPWFk%3D&webInteractiveContentId=171495116167&portalId=22332934) ## Related posts [![meeting PCI requirements for encryption](https://blog.basistheory.com/hubfs/pci-requirements-encryption.png)](https://blog.basistheory.com/pci-requirements-encryption) [PCI Compliance](https://blog.basistheory.com/tag/pci-compliance) ### [Meeting PCI Requirements for Encryption](https://blog.basistheory.com/pci-requirements-encryption) ![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) December 26, 2023 [Read more](https://blog.basistheory.com/pci-requirements-encryption) [![](https://blog.basistheory.com/hubfs/12%20pci%20compliance%20requirements.webp)](https://blog.basistheory.com/12-pci-dss-requirements) [PCI Compliance](https://blog.basistheory.com/tag/pci-compliance) ### [How many PCI requirements are there? A guide to PCI](https://blog.basistheory.com/12-pci-dss-requirements) ![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) October 6, 2025 [Read more](https://blog.basistheory.com/12-pci-dss-requirements) [![what is PCI compliance?](https://blog.basistheory.com/hubfs/Imported_Blog_Media/6388c6ad1d41f576264c74da_What%20is%20PCI%20Compliance_%20%20The%2012%20Requirements%20%20%26%20PCI%20DSS%20Guide.jpg)](https://blog.basistheory.com/pci-compliance-12-requirements-pci-dss-guide) [PCI Compliance](https://blog.basistheory.com/tag/pci-compliance) ### [What is PCI Compliance? The 12 Requirements & PCI DSS Guide](https://blog.basistheory.com/pci-compliance-12-requirements-pci-dss-guide) ![Picture of Jordan Lampe](https://blog.basistheory.com/hs-fs/hubfs/Imported_Blog_Media/61f0194b9463877ad90ecb1f_jordan-lampe.png?width=50&name=61f0194b9463877ad90ecb1f_jordan-lampe.png) [Jordan Lampe](https://blog.basistheory.com/author/jordan-lampe) December 1, 2022 [Read more](https://blog.basistheory.com/pci-compliance-12-requirements-pci-dss-guide) ## Stay Connected ### Receive the latest updates straight to your inbox ### Follow on Social [![BTLogo (1)](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=138&height=46&name=BTLogo%20(1).png "BTLogo (1)")](https://basistheory.com) - Use Cases - [Creator Economy](https://basistheory.com/use-cases/creator-economy) - [Digital Health](https://basistheory.com/use-cases/health) - [E-Commerce](https://basistheory.com/use-cases/ecommerce) - [Fintech](https://basistheory.com/use-cases/fintech) - [Gaming](https://basistheory.com/use-cases/gaming) - [Remittance](https://basistheory.com/use-cases/remittance) - [Subscription Platforms](https://basistheory.com/use-cases/subscriptions) - [Online Travel Agencies](https://basistheory.com/use-cases/travel) - [Vertical SaaS](https://basistheory.com/use-cases/vsaas) - Developers - [Quickstart](https://developers.basistheory.com/getting-started) - [Elements](https://developers.basistheory.com/docs/sdks/web/javascript) - [Documentation](https://developers.basistheory.com/) - Basis Theory - [Pricing](https://basistheory.com/pricing) - [Add-Ons](https://basistheory.com/add-ons) - [ROI Calculator](https://go.basistheory.com/roi) - [Case Studies](https://blog.basistheory.com/case-studies) - [Blog](https://blog.basistheory.com) - [Contact](https://basistheory.com/contact) - Other - [Terms and Conditions](https://basistheory.com/resources/terms-of-service) - [Privacy Policy](https://basistheory.com/resources/privacy-policy) - [Cookie Policy](https://basistheory.com/resources/cookie-policy) - [Security](https://basistheory.com/security) - [System Status](https://status.basistheory.com/) - Compare - [Basis Theory Vs. Evervault](https://go.basistheory.com/evervault-alternative) - [Basis Theory Vs. IXOPAY](https://go.basistheory.com/alternative-to-ixopay) - [Basis Theory Vs. VGS](https://go.basistheory.com/compare/very-good-security) --- ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Basis Theory", "url" : "https://blog.basistheory.com/author/basis-theory-team" }, "dateModified" : "2025-03-28T18:37:32.293Z", "datePublished" : "2024-11-06T10:45:00.000Z", "headline" : "PCI 4.0 in 2025: What best practices are becoming requirements?", "image" : [ "https://blog.basistheory.com/hubfs/2025%20PCI%20Requirement%20update.png" ], "mainEntityOfPage" : { "@id" : "https://blog.basistheory.com/pci-requirements-in-2025", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.basistheory.com/hubfs/BTLogo%20(1).png" }, "name" : "Basis Theory" } } ```