The PCI Security Standards Council does not publish a ranked list of failed requirements. Public merchant data from assessment vendors points to Requirement 12 gaps: security policy, incident response plans, risk assessments and service provider oversight. Check those first, then scope, scripts on payment pages and access reviews.
Which version is in force?
The PCI SSC announced PCI DSS v4.0.1 as a limited revision that fixes typos and clarifies intent without adding or removing requirements. v4.0 retired on 31 December 2024, leaving v4.0.1 as the supported version. The future dated requirements introduced in v4.0 took effect on 31 March 2025, so assessments now test them as normal requirements. When you read "PCI DSS 4.0 findings", the working standard is v4.0.1.
What does the public data say?
Be careful with sources here. We found no official PCI SSC ranking. The closest public data is a vendor page from SecurityMetrics, which says it scanned its merchant database and lists the top failing areas for self assessment questionnaires:
- 12.1, the security policy
- 12.10.1, the incident response plan
- 12.2, the annual risk assessment
- 12.8.4, monitoring service providers' compliance
- 12.5.3, incident response and escalation procedures
- 12.5.4, user account administration
- 12.5.5, monitoring and controlling access to data
- 12.6.a, the security awareness program
- 12.8.5, tracking which requirements service providers manage
- 12.1.1, the annual policy review
The page gives no sample size, counts or year, and its introduction says the list starts with the least adopted requirement, which sits oddly with a "most failed" label. Read it as a pattern across smaller merchants, not a statistic. Notice the theme: almost all of it is documentation, ownership and process rather than technology.
Other recurring themes appear in practitioner commentary, though we could not confirm them against an independent dataset: incomplete scoping of systems that touch cardholder data, gaps in managing scripts on payment pages, and access reviews on a looser schedule than the standard expects. Treat those as prompts to check, not as measured rates.
What changed in practice with 4.0.1?
The PCI SSC notes several clarifications worth knowing:
- Requirement 6: the 30 day patching expectation applies to critical vulnerabilities, restoring the older wording, and there are applicability notes on managing payment page scripts.
- Requirement 8: multi-factor authentication for non administrative access into the cardholder data environment does not apply to accounts that use only phishing resistant factors.
- Requirement 12: applicability notes on customer and third party service provider relationships were updated.
How should you prepare?
- Write down ownership. For each Requirement 12 item, name the person who owns the document, the review date and where it is stored.
- Test the incident response plan. Run a tabletop exercise and keep the notes. An untested plan is a common weak point.
- Do the annual risk assessment on a calendar. Put the date in the compliance calendar and keep the output.
- List every service provider. Record which PCI requirements each one covers and which stay with you, and get their attestation of compliance.
- Confirm scope. Draw where cardholder data flows, including cloud services and third parties, and check segmentation.
- Inventory payment page scripts. Know what runs, who authorized it and how changes are detected.
- Gather evidence early. Screenshots in a shared folder do not age well. Keep dated exports with a clear owner.
Where does software supply chain fit?
PCI DSS expects you to know the software components in your environment and to patch known flaws. A current dependency inventory and reachability analysis help with the vulnerability management evidence. Safeguard's compliance automation can help collect that evidence, but it does not certify you. Only a qualified assessor or your acquirer can assess PCI compliance.
Quick check
Is there an official list of most failed PCI DSS requirements?
We found none from the PCI SSC. Vendor lists exist, such as the SecurityMetrics one, but they do not disclose sample sizes or years, so use them as hints.
Are the future dated 4.0 requirements still optional?
No. The PCI SSC states they took effect on 31 March 2025, and v4.0.1 did not change that date.
Sources
Last reviewed: 18 October 2026.
