PCI DSS 4.0.1: Application Requirements You’re Being Assessed On in 2026
PCI DSS 4.0.1 updates now fully score former 'best practice' requirements for 2026 assessments.
Run Qualys?
Get an email when a reviewed story names Qualys, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
PCI DSS 4.0.1 has fully integrated 51 former 'best practice' requirements into its scoring for all assessments starting March 31, 2025. A significant portion of these new requirements focus on application security, particularly in Requirements 6 and 11, emphasizing the need for comprehensive inventories of custom applications and APIs, continuous protection of public-facing applications, and robust payment page script management. Organizations must now actively manage and secure these elements, as they will be critical components of their 2026 PCI DSS assessments.
The lesson from this incident
Full lessonPCI DSS 4.0.1 has formally promoted 51 previously optional 'best practice' controls into mandatory scored requirements, with a heavy focus on application security under Requirements 6 and 11. Organizations that treated API inventories, public-facing application protection, and payment page script management as aspirational rather than essential are now directly exposed to compliance failures. The shift reflects the reality that web skimming attacks, unmanaged APIs, and shadow applications are among the most exploited attack surfaces in payment environments. Failing to meet these requirements by the March 31, 2025 assessment cycle means organizations risk both regulatory penalties and the real-world breaches these controls are designed to prevent.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.
- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.