PCI DSS v4.0.1: What Managers Are Responsible For

Under the Payment Card Industry Data Security Standard (PCI DSS) v4.0.1, managers are responsible for making sure security roles are assigned and acknowledged, that staff get security awareness training at hire and every 12 months, that targeted risk analyses justify how often key controls run, and that service providers are tracked and held to written agreements. Since 31 March 2025, the requirements that were previously best practice are mandatory. This guide sets out what that means for a finance or operations manager, and what evidence an assessor will expect to see.

Where PCI DSS v4.0.1 stands now

PCI DSS v4.0 was published in March 2022 and retired on 31 December 2024. Version 4.0.1, a limited revision, was published in June 2024 and is the version organisations now assess against (PCI Security Standards Council, 2024). Of the 64 new requirements introduced with version 4, 51 were future-dated and became effective on 31 March 2025 (PCI Security Standards Council, 2024). In June 2026 the Council opened a request for comments on v4.0.1 to begin work on the next iteration, but v4.0.1 remains the published standard (PCI Security Standards Council, 2026).

If you need a refresher on the basics of scope and the twelve principal requirement areas, start with our PCI DSS compliance guide for finance and accounting teams. This post focuses on what lands on a manager's desk.

Roles, responsibilities and executive ownership

PCI DSS v4.0.1 expects people, not just policies, to own security:

• Roles are defined and acknowledged. The security policy must define information security roles for all personnel, and staff must be aware of and acknowledge their responsibilities (Requirement 12.1.3).
• An executive owns information security. Responsibility must be formally assigned to a Chief Information Security Officer or another security-knowledgeable member of executive management (Requirement 12.1.4).
• Service providers need executive accountability. If your organisation is a service provider, executive management must take responsibility for protecting cardholder data and set a charter for the compliance programme (Requirement 12.4.1).

In practice, many teams use a responsibility matrix (often called a RACI chart, for responsible, accountable, consulted and informed) that shows who performs, approves and reviews each requirement. It is one of the most useful documents you can hand an assessor.

Security awareness: Requirement 12.6

Requirement 12.6 is the one most managers will be asked about directly. It requires:

• A formal security awareness programme that makes all personnel aware of the security policy and their role in protecting cardholder data (12.6.1).
• A review of that programme at least once every 12 months, updated for new threats (12.6.2, mandatory since 31 March 2025).
• Training on hire and at least once every 12 months, using more than one method of communication, with staff acknowledging the security policy at least once every 12 months (12.6.3).
• Content on phishing and social engineering (12.6.3.1, mandatory since 31 March 2025). The standard is explicit that technical anti-phishing controls do not satisfy this training requirement, and vice versa.
• Content on acceptable use of end-user technologies such as laptops, phones and remote access (12.6.3.2, mandatory since 31 March 2025).

Separately, staff who work with payment terminals need specific training on spotting tampering and verifying anyone claiming to be a repair technician (Requirement 9.5.1.3). Build that into induction for reception, collections and anyone else who handles card readers or takes card details by phone.

Targeted risk analysis

Version 4 lets organisations set the frequency of some controls themselves, but only if they justify it. Where a requirement calls for a targeted risk analysis, it must document the assets being protected, the threats, the factors affecting likelihood and impact, and how the chosen frequency or approach reduces the risk. Each analysis must be reviewed at least once every 12 months (Requirement 12.3.1, mandatory since 31 March 2025).

Examples managers often own include how frequently payment terminals are inspected (9.5.1.2.1) and how often incident response staff are trained (12.10.4.1). The Council publishes targeted risk analysis guidance and a sample template on its website, which is a sensible starting point.

Access reviews and scope

Two other requirements regularly fall to line managers:

• Six-monthly access reviews. All user accounts and access privileges, including third-party accounts, must be reviewed at least once every six months, with management confirming that access remains appropriate (Requirement 7.2.4, mandatory since 31 March 2025).
• Annual scope confirmation. Scope must be documented and confirmed at least once every 12 months and after significant change, including every payment channel such as phone and e-commerce (Requirement 12.5.2). Service providers must do this every six months (12.5.2.1).

Service providers

Most finance teams rely on payment gateways, call-recording vendors or outsourced collections. PCI DSS requires you to keep a list of all third-party service providers that handle or could affect account data (12.8.1), maintain written agreements in which they acknowledge responsibility for that data (12.8.2), vet them before engagement (12.8.3), monitor their compliance status at least once every 12 months (12.8.4) and record which requirements each party manages (12.8.5). For broader supplier controls, see our guide to third-party technology and cloud security.

Evidence assessors will expect

Keep evidence dated and in one place. Assessors look for proof that activities happened on schedule, not just that a policy says they will.

This article is general information and not legal or compliance advice. Your acquirer and assessor decide how PCI DSS applies to your organisation.

Frequently asked questions

Which PCI DSS requirements became mandatory on 31 March 2025?

The 51 future-dated requirements from version 4, including the annual awareness programme review, phishing and social engineering training, targeted risk analysis and six-monthly access reviews. Check the applicability notes in the standard for the full list.

Do I need to run phishing simulations?

The standard requires training that covers phishing and social engineering, not a specific format. Simulations can be one of the "multiple methods" Requirement 12.6.3 calls for.

Does outsourcing payments remove our PCI DSS responsibilities?

No. It can reduce scope, but you must still manage your providers under Requirement 12.8 and train your own staff.

Clear roles, dated evidence and well-trained staff make an assessment far less stressful. For ongoing development, Learnsignal's compliance CPD courses for finance professionals help managers keep their knowledge current.