PCI DSS v3.2.1 Officially Retired
PCI DSS v3.2.1 was officially retired on March 31, 2024 after a two-year transition period, making v4.0 the sole active version at that time. Assessments initiated after this date could no longer use v3.2.1. The standard has since evolved further: PCI SSC published a limited revision, v4.0.1, in June 2024 and retired v4.0 on December 31, 2024, and the future-dated v4.0 requirements became mandatory on March 31, 2025. All assessments now validate against v4.0.1 with the full requirement set in force.
Key Analytics
Impact Analysis
The v3.2.1 sunset marked the end of the grace period for organizations that delayed their v4 transition. Qualified Security Assessors (QSAs) now issue Reports on Compliance (ROCs) and Self-Assessment Questionnaires (SAQs) exclusively against v4.0.1, and the formerly future-dated requirements, including targeted risk analysis, payment page script integrity monitoring, and enhanced authentication controls, are fully enforceable as of March 31, 2025. Organizations still carrying unremediated v4 gaps are non-compliant and at risk of acquiring bank enforcement.
Recommended Actions
- Confirm all compliance documentation, evidence collection, and assessment procedures reference PCI DSS v4.0.1, the only active version since January 1, 2025
- Remediate any remaining gaps against requirements that had no v3.2.1 equivalent, since no best-practice grace period remains
- Verify the formerly future-dated requirements (mandatory since March 31, 2025), including targeted risk analysis, script integrity monitoring, and enhanced authentication controls, are implemented and evidenced
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Gap remediation for requirements with no v3.2.1 equivalent
- ›Evidence collection for the formerly future-dated requirements
- ›Documentation and SAQ retargeting to v4.0.1
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 135 to 285 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.