If your store or restaurant takes credit cards, the Payment Card Industry Data Security Standard, or PCI DSS, applies to you. The older version 3.2.1 was retired on March 31, 2024. Version 4.0 came with a set of new requirements that were treated as best practices for a year, and on March 31, 2025, those became mandatory.
So if your last review was done under the old rules, some of what you are doing may no longer be enough.
The short version
- The remaining PCI DSS 4.0 requirements have been mandatory since March 31, 2025.
- The biggest changes are around logins, phishing and online payment pages.
- How much applies to you depends on how you take cards. Your payment processor can tell you which self-assessment form you need.
What changed
- Multi-factor authentication for more people. It is now required for all access into the systems that handle card data, not only for administrators.
- Longer passwords. The minimum length is now 12 characters where systems support it.
- Protection against phishing. Businesses need processes and tools to detect phishing and protect staff from it.
- Online payment pages. If you host a page where customers type in card numbers, you need to know which scripts run on it, confirm each one is authorized, and detect changes or tampering.
- Deeper vulnerability scans. Internal scans need to run with login credentials, so they see more than a scan from the outside would.
- Automated log review. Reviewing security logs by hand is no longer enough.
- Documented risk decisions. Where the standard lets you choose how often to do something, you need a written risk analysis to back up the choice.
The full standard and supporting documents are in the PCI Security Standards Council document library.
What it means for a store or restaurant
Your workload depends on how cards are handled. A shop with standalone terminals that connect straight to the processor has a much shorter list than a restaurant group with a networked point-of-sale system, online ordering and stored customer profiles. Your processor or acquiring bank can confirm which self-assessment questionnaire applies to you.
Using a third-party online ordering or payment provider reduces how much falls on you. It does not remove your responsibility to confirm that the provider is compliant.
A practical checklist
- Keep the point-of-sale system on its own network, separate from guest Wi-Fi and office computers. This is a core part of good network design.
- Give every employee their own login. No shared manager codes.
- Turn on multi-factor authentication for back-office and remote access.
- Change every vendor default password on routers, terminals and cameras.
- Keep the point-of-sale software, operating systems and network equipment updated.
- Check card terminals regularly for tampering or skimming devices.
- Lock down remote access used by your point-of-sale vendor.
- Do not store card numbers anywhere, including on paper, in email or in spreadsheets.
- Train staff to spot phishing and to report anything odd.
- Complete your self-assessment every year and keep the paperwork.
Xceltek supports retail and hospitality businesses with cybersecurity and PCI-DSS assessment and remediation.
Not sure where you stand under version 4.0?
We can review how your business takes cards and what the updated standard asks of you.
Common questions
Does PCI DSS apply to a small shop or restaurant?
Yes. It applies to any business that accepts payment cards. Smaller businesses usually have a shorter list of requirements, depending on how they process cards.
Is PCI DSS a law?
No. It is an industry standard set by the card brands and enforced through your agreement with your payment processor or bank, which can charge fees or penalties for non-compliance.
We use a third party for online ordering. Are we covered?
It reduces what you have to do yourself, but you are still responsible for confirming that the provider is PCI compliant and for securing the parts you control.
