PCI DSS 4.0 introduced a set of new requirements labeled as best practice until a future date, and the PCI SSC says all new requirements that apply to you must be fully considered once they take effect. If your assessment is in 2026, treat them as fully in force.
The timeline, in short
Secondary reports put the dates like this. PCI DSS v4.0.1 was published in June 2024 as a limited revision. Version 4.0 was retired at the end of 2024. The future-dated requirements became mandatory on 31 March 2025, and secondary sources put their number at 51. I could not confirm these dates and the count against a PCI SSC primary page, so check the Council's document library before citing them to an assessor.
What the FAQ says
PCI SSC FAQ 1564 (dated March 2023) explains how to report requirements that were best practice until a future date:
- If you had not implemented one and finished your report before it took effect, it could be marked Not Applicable.
- The same applied when you relied on a third party service provider with a current assessment against the version then in force that did not cover the new requirements.
- Early implementers could choose to include them.
- After the effective date, all new requirements that apply to you, including those a third party meets for you, must be fully considered.
The window described in that FAQ has closed, so the Not Applicable route is no longer available for them.
What this means for your next assessment
- List the requirements that were future-dated from the current standard and mark each as applicable, met, or not applicable with a written reason.
- Check your service providers. Ask for their responsibility matrix and current attestation, and confirm it covers the new requirements that matter to you.
- Collect evidence early. Many of these ask for ongoing activity, such as reviews, scans or monitoring, and an assessor will want to see it recurring.
- Assign owners. A requirement without an owner tends to lapse between assessments.
- Do not rewrite history. If a control only started recently, say so. Evidence dated before the control existed will not help.
Common gaps to look for
Look at areas like script control on payment pages (see payment page scripts and SAQ A), developer training records (see Requirement 6.2.2 records) and any requirement that depends on a vendor.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through the framework mapping and notice how one piece of evidence can support several controls.
Safeguard supports compliance and evidence automation as a GA capability. Whether you meet a requirement is for you and your assessor to decide.
Quick check
Can I still mark a former future-dated requirement as Not Applicable because it was not yet required?
Not on that basis. Per FAQ 1564, after the effective date all new requirements that apply to you must be fully considered.
Sources
Last reviewed: 19 October 2026.
