The Payment Card Industry Data Security Standard (PCI DSS) applies to every organisation that stores, processes or transmits cardholder data. Version 4.0 was published in March 2022, version 3.2.1 was retired at the end of March 2024, and the requirements that were "future-dated" in 4.0 became mandatory on 31 March 2025. A minor revision, 4.0.1, followed in June 2024.
Start by shrinking your scope
The cheapest PCI control is the one you do not need. If card data never touches your servers, because you use a payment page hosted by your payment provider or tokenisation, most requirements fall away. Before anything else, map exactly where card data flows and see how much of it you can remove.
What the hosting layer must provide
Where card data does pass through your systems, the servers and network around it need:
- Network segmentation, so the cardholder data environment is separated from everything else.
- Firewalls with documented, reviewed rules.
- Strong cryptography for data in transit and at rest.
- Timely patching of operating systems and software.
- Multi-factor authentication for all access into the cardholder data environment, a requirement that 4.0 broadened.
- Centralised logging, with logs reviewed and retained.
- Regular vulnerability scans and penetration tests.
Notable changes in 4.0
- A targeted risk analysis lets organisations justify how often some controls are performed.
- Stronger password and MFA requirements.
- Protection of payment pages against script tampering in the browser.
- A customised approach, allowing alternative controls that meet a requirement's stated objective.
Shared responsibility
When you host with a provider, responsibility is split. The provider typically covers physical security and parts of the infrastructure; you remain responsible for your applications, configurations and users. Ask your provider exactly which requirements they cover, in writing.
How IDX helps
IDX dedicated servers and Egypt Servers can be built to keep payment workloads separated, with private networking, firewalls and logging set up for your environment. Our NOC and SOC services provide monitoring and incident response, and our team can help you document which controls sit with us and which with you.
IDX on digital infrastructure
Back to blog →