Payment Card Industry Data Security Standard (PCI DSS) news from Infosec Standards https://infosecstandards.org/standards/pci-dss News about Payment Card Industry Data Security Standard (PCI DSS), including major updates to our page on it. en-us Standard pages now say who decides your obligation, and what to ask them https://infosecstandards.org/news/who-decides-what-to-ask https://infosecstandards.org/news/who-decides-what-to-ask Thu, 03 Sep 2026 00:00:00 GMT The HIPAA, PCI DSS, CMMC, and SOC 2 pages each gained a section naming the party that actually sets your obligation and the questions to put to them in writing. HIPAA and SOC 2 also gained a first-decision picker. Infosec Standards now has a free, browser-only risk assessment tool https://infosecstandards.org/news/risk-assessment-tool https://infosecstandards.org/news/risk-assessment-tool Wed, 02 Sep 2026 00:00:00 GMT Infosec Standards now has a guided, NIST SP 800-30 based risk assessment tool. Everything stays in your browser; you leave with a JSON file to resume from, a spreadsheet register, and a printable report. PCI SSC revises FAQ 1331 on using SAQs to scope ROC assessments https://infosecstandards.org/news/pci-dss-roc-saq-guide https://infosecstandards.org/news/pci-dss-roc-saq-guide Mon, 10 Aug 2026 00:00:00 GMT On August 4, 2026, PCI SSC updated FAQ 1331 so merchants cannot use SAQ eligibility criteria to decide ROC applicability without Compliance Accepting Entity agreement. PCI DSS v4.0.1 is the current standard https://infosecstandards.org/news/pci-dss-v4-0-1 https://infosecstandards.org/news/pci-dss-v4-0-1 Tue, 11 Jun 2024 00:00:00 GMT On June 11, 2024, PCI SSC published PCI DSS v4.0.1, a limited revision of v4.0. Future-dated v4 requirements became mandatory on March 31, 2025.