Skip to content
PCI DSS version 4.0 tossed out compensating controls and introduced a more flexible structure with customized implementation options.

Out With The Old, In With The New

The release of PCI DSS 4.0 ushers in a new and improved set of standards for protecting customer payment data. These standards apply to any organization that accepts credit, debit, or prepaid cards under the American Express, Discover, MasterCard, Visa, and Japan Credit Bureau brands.


Customized Implementation Replaces Compensating Controls

The processes for implementing alternative security measures have been updated: Customized implementation has replaced compensating controls in v4.0. Compensating controls are an alternative solution or set of measures to satisfy a security or compliance requirement that is not possible for the organization to put in place in its original form. 

The updated customized implementations are much more accommodating: organizations no longer need to provide a justification for deviation from PCI regulations.  Customized implementations consider the intent of the objective and allow organizations to design their own security controls to meet it. The customized approach supports innovation in security practices, allowing entities greater flexibility to show how their current security controls meet PCI DSS objectives. Once an organization determines the security control for a given objective, it must provide full documentation to enable its Qualified Security Auditor (QSA) to make a final decision on the effectiveness of a control. 

If your organization plans on utilizing the customized implementation option, you need to be prepared to provide clear justification for using compensating controls. QSAs will at the time of assessment need to review the technology and methods used to determine whether or not the customized implementation meets or exceeds the goals of the original regulation. This requires that your organization maintain the RoC and SAQ documents and worksheets provided by PCI SSC.

More from the Blog

June 14, 2023

The Future Of MFA Is Here And Its Continuous Multi-Factor Authentication

The Limitations of Traditional MFA Most people are familiar with multi-factor authentication, whether from setting up a...
February 8, 2023

Contact Centers Need More Than Traditional MFA

Multi-factor authentication is a foundational component of every well-rounded security posture. In March 2024, it will...
August 17, 2023

Simplify Identity Security for Work-at-Home Agents with Twosense

When implementing multi-factor authentication for agent identity, BPOs have historically been in a challenging position...

Subscribe Here

We will never share your email address with third parties.