Skip to content
Auditor sitting at a desk holding compliance audit report.
PCI DSS version 4.0 tossed out compensating controls and introduced a more flexible structure with customized implementation options.

Out With The Old, In With The New

The release of PCI DSS 4.0 ushers in a new and improved set of standards for protecting customer payment data. These standards apply to any organization that accepts credit, debit, or prepaid cards under the American Express, Discover, MasterCard, Visa, and Japan Credit Bureau brands.


Customized Implementation Replaces Compensating Controls

The processes for implementing alternative security measures have been updated: Customized implementation has replaced compensating controls in v4.0. Compensating controls are an alternative solution or set of measures to satisfy a security or compliance requirement that is not possible for the organization to put in place in its original form. 

The updated customized implementations are much more accommodating: organizations no longer need to provide a justification for deviation from PCI regulations.  Customized implementations consider the intent of the objective and allow organizations to design their own security controls to meet it. The customized approach supports innovation in security practices, allowing entities greater flexibility to show how their current security controls meet PCI DSS objectives. Once an organization determines the security control for a given objective, it must provide full documentation to enable its Qualified Security Auditor (QSA) to make a final decision on the effectiveness of a control. 

If your organization plans on utilizing the customized implementation option, you need to be prepared to provide clear justification for using compensating controls. QSAs will at the time of assessment need to review the technology and methods used to determine whether or not the customized implementation meets or exceeds the goals of the original regulation. This requires that your organization maintain the RoC and SAQ documents and worksheets provided by PCI SSC.

More from the Blog

September 25, 2019

PROCESS: Machine Learning Engineering Tactics at Twosense

At TWOSENSE.AI, we build Enterprise products that implement continuous biometric authentication.  Our core technology...
April 1, 2022

Biometrics are Here to Stay

A recent study by MaretsandMarkets noted that the global biometric system market is expected to grow to $68.6 billion...
April 11, 2022

BREAKING: What You Need to Know About PCI DSS 4.0

In 2006, the Payment Card Industry Security Standard Council (PCI SSC) launched a set of requirements to ensure that...

Sign Up for our Blog

We will never share your email address with third parties.