PCI DSS v4.0 vs v3.2.1 cost delta: the math

The v4.0 calendar and what it means for 2026

PCI DSS v4.0 was published in March 2022. The PCI SSC gave a two-year transition during which both v3.2.1 and v4.0 were accepted for assessments. PCI DSS v3.2.1 retired in March 2024. 51 of the v4.0 requirements were marked as future-dated during the transition, becoming mandatory in March 2025. As of mid-2026, every PCI assessment must apply the full v4.0 control set including all future-dated requirements. There is no remaining transition relief.

For merchants whose last ROC or SAQ was completed under v3.2.1 (typically merchants on annual cycles where their last assessment was Q1 2024 or earlier), the 2025 or 2026 renewal is the first encounter with full v4.0 requirements. This page covers the cost decomposition of that uplift, organised around the four highest-cost v4.0 changes.

The 51 future-dated requirements vary widely in cost impact. Some are clarifications of existing v3.2.1 requirements that most merchants already meet (cost impact near zero). Others introduce genuinely new compliance obligations requiring new tooling and consultant time (cost impact $2,000 to $15,000+ per requirement). The four most-expensive new requirements account for roughly 70 to 80 percent of the total v4.0 uplift.

The four most-expensive new v4.0 requirements

Anchored to the official PCI DSS v4.0 document library and the PCI SSC v4.0 Summary of Changes document. The cost ranges assume merchants who did not meet the requirements under v3.2.1; merchants who already met the spirit of the requirement see lower or zero incremental cost.

Req 6.4.3 payment-page script management in detail

Req 6.4.3 is the single most-discussed v4.0 change because it created a new tooling category and a new line item in nearly every e-commerce merchant's compliance budget. The requirement: any merchant whose payment page can load third-party scripts (including via tags managed in Google Tag Manager, marketing scripts, analytics, chat widgets, A/B testing tools) must inventory every script loaded on the payment page, authorise each script via documented business need, and verify the integrity of each script (typically via subresource integrity hashes or via continuous integrity monitoring).

The requirement targets Magecart-style payment-page skimming attacks, where attackers compromise a third-party script (a marketing tag, a chat widget, a tracking pixel) and inject code that exfiltrates cardholder data as customers type it into the payment form. The 2018 British Airways breach (108,000 cards exfiltrated, GBP 20 million GDPR fine) was a textbook Magecart attack. Req 6.4.3 makes detection of such attacks structurally mandatory.

Compliance options. Option one: pure manual evidence with subresource integrity hashes on every script tag, periodic manual review of the script inventory, manual change-approval workflow. Labour-intensive but no tool cost. Option two: a payment-page script monitoring tool. Pure-play products include c/side ($2,400 to $6,000 per year), Jscrambler ($3,000 to $10,000), Source Defense ($5,000 to $15,000 per year for enterprise). CDN-integrated alternatives include Cloudflare Page Shield (included with Cloudflare Pro/Business/Enterprise plans, marginal cost roughly $0 to $2,000 depending on existing Cloudflare tier), Akamai Script Manager (included with Akamai Bot Manager subscription). For most merchants the tool path is operationally cleaner than manual evidence.

Per-merchant-tier v4.0 cost uplift

The uplift assumes a merchant who was compliant under v3.2.1 with minimal additional security investment beyond the baseline. Merchants with mature security programs that already met the spirit of the v4.0 requirements see lower uplift. The cost impact does not include the general professional services inflation (separately roughly +5 to +8 percent YoY) that affects both v3.2.1 and v4.0 baselines.

v4.0 cost mitigation strategies

Three approaches consistently reduce the v4.0 cost uplift. First, scope reduction through hosted checkout migration. Moving from SAQ A-EP to SAQ A through Stripe Checkout, PayPal hosted, or Adyen Drop-in eliminates the Req 6.4.3 obligation entirely (because the payment page is hosted outside the merchant's environment) and minimises the other v4.0 cost impacts. The migration cost runs $5,000 to $25,000 one-off; the year-over-year SAQ cost saving plus elimination of v4.0 tooling typically pays back within the first year.

Second, GRC platform adoption for multi-framework engagements. The compliance automation platforms (Vanta, Drata, Secureframe, Sprinto, Thoropass) have invested heavily in v4.0 evidence templates and the platforms now meaningfully reduce the consultant or QSA hours required for v4.0 evidence collection. For Level 2 and Level 1 merchants with combined PCI plus SOC 2 plus ISO 27001 obligations, the GRC platform amortises the v4.0 cost across frameworks.

Third, leveraging existing security investments for v4.0 requirements. Many of the v4.0 future-dated requirements can be met by extending existing security tools and processes rather than buying new ones. Examples: extending an existing Okta or Microsoft Entra deployment to cover all CDE access (Req 8.3), using an existing Cloudflare or Akamai CDN for script monitoring (Req 6.4.3), using an existing Tenable or Qualys deployment for authenticated internal scanning (Req 11.3.2). The audit conversation with the QSA is whether these existing tools meet the v4.0 evidence requirements, and in most cases they do with modest configuration changes.