PCI DSS v4.0 vs v4.0.1: What the Errata Changed

Nature of 4.0.1

Errata typically fix ambiguities, align guidance, and correct inconsistencies. Your customized approach / TRA artefacts may need wording updates even if intent is unchanged.

Programme actions

• Diff your control narratives to 4.0.1 text
• Update SAQ/RoC templates to the current version
• Brief assessors on any open compensating controls

Future-dated items

Keep tracking future-dated requirement effective dates separately from errata wording.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Do we re-certify solely for 4.0.1?

Follow acquirer/QSA direction — usually adopt current version at next assessment.

Is 4.0.1 optional?

Assessments should use the current SSC-published standard.

Where is the change list?

PCI SSC official summary of changes.

Related Resources

• v3.2.1 vs v4
• Future-dated