PCI DSS v4.0.1 is the current version of the Payment Card Industry Data Security Standard, fully applicable since March 2025. For a PSP, PayFac or ISV that handles cardholder data, compliance means recurring costs in network and endpoint security, scanning, penetration testing, QSA assessments and security staff, much of which a PCI DSS validated white-label payment infrastructure can absorb.
PCI DSS is not a law, but acquirers, card schemes and partners require it contractually, so every operator that touches card data has to budget for it every year. This article, updated in October 2026, explains what changed with PCI DSS 4.0, who must comply, which cost lines a service provider faces, how much security staffing it takes, and when it makes sense to rely on a validated infrastructure rather than certify your own platform.
What changed with PCI DSS 4.0 and when did it become mandatory?
Version 4.0, published in March 2022, replaced v3.2.1 for all assessments from March 31, 2024. Its "future-dated" requirements, such as payment page script controls, authenticated internal scans and multi-factor authentication for all access to the cardholder data environment, became mandatory on March 31, 2025. Since December 31, 2024, v4.0.1 is the only active version, according to the PCI Security Standards Council.
The philosophy changed too: controls must meet defined objectives, supported by targeted risk analyses, rather than tick fixed boxes. That gives mature organizations flexibility, but also means more documentation and more ongoing work. The PCI DSS v4.0 guide for PayFacs details the requirements.
Who must comply: merchants, service providers or both?
Both, with different obligations. Merchants validate their compliance through a self-assessment questionnaire or an on-site assessment, depending on their volume and on how they handle card data. Service providers, which include PSPs, PayFacs, processors and many ISVs, carry wider obligations because they store, process or transmit card data on behalf of others.
Using a certified provider reduces a merchant's or operator's scope, but never removes it entirely: responsibilities are shared and must be documented. The SAQ A, A-EP and D article explains how scope works for merchants.
How much do network and endpoint security cost per year?
Network security covers a web application firewall, DDoS protection, intrusion detection and secure DNS, bought as a managed service or built and maintained in-house. Endpoint security covers next-generation antivirus and endpoint detection and response on every workstation and server, plus mobile device management.
Both are priced per traffic, per endpoint or per subscription tier, and both grow with the organization. They are also the controls assessors look at first, so cutting corners here is rarely an option.
How much do scanning, pentesting and the QSA assessment cost?
Recurring testing is a fixed line: quarterly external scans by an Approved Scanning Vendor, authenticated internal scans, and penetration tests at least annually and after significant changes, with segmentation tests every six months for service providers.
Then comes validation. A service provider handling significant volumes needs a Report on Compliance and an Attestation of Compliance from a Qualified Security Assessor every year, an engagement whose cost depends heavily on the size and complexity of the environment in scope.
How much security staffing does PCI DSS compliance require?
More than most teams expect. A service provider needs someone accountable for security, typically a CISO, and security operations staff to run policies, timed processes, log reviews, vulnerability management and incident response. These profiles are scarce and expensive, and recruitment, training and retention add to the bill.
Based on NORBr's own security team's estimates, a service provider running its own cardholder data environment should expect a total compliance budget in the range of several hundred thousand dollars a year once staffing is included, before adding SIEM, extended detection, other certifications such as ISO 27001 or SOC 2, and privacy compliance.
Should a PSP or PayFac certify its own platform or rely on a validated infrastructure?
It depends on whether running a cardholder data environment is part of the business. Operators that differentiate on their own processing technology may choose to own it and its compliance. For most PSPs, PayFacs, ISOs and ISVs, keeping card data out of their own systems is the faster and cheaper path.
On NORBr, card capture, vaulting and tokenization run on a platform validated as a PCI DSS service provider and listed on the Visa Global Registry of Service Providers. Operators keep a reduced scope and a clear split of responsibilities, described in platform operations and security and compared in the build vs buy analysis.
_%2520a%2520game%2520changer%2520for%2520digital%2520transactions_-Cover.webp){kind=spacer}
