Still Haven’t Switched to PCI 4? Here’s What You Need to Do RIGHT NOW.

The deadline to transition to PCI DSS 4 is March 31 — less than three very short months from now. Perhaps it shouldn’t be surprising, but the vast majority of organizations still have not made the switch. 

You can sign off on a PCI 3.2.1 AOC up until the end of March. If your annual PCI assessment falls on April 1 or later, you must be assessed under PCI 4. If you haven’t made the transition yet, you have precious little time to get your company ready for your assessment.

Depending on your company’s circumstances, you may still have some options, even at this late stage of the game. Here’s what you need to do if you still need to transition to PCI DSS 4.

Get TCT’s complete guide to PCI DSS Certification

How Much Work Will It Be to Move to PCI 4?

Switching to PCI DSS 4 requires a ton of heavy lifting, and many organizations are surprised how much work needs to be done. There’s a lot of planning and analysis involved. You may have organizational changes that need to be implemented. You’ll need to have a series of internal discussions and coordinate with your Assessor. 

It will take time and effort to get your arms around the new requirements and figure out how they impact your organization. There will be changes to your policies and procedures, followed by several rounds of confirmations, double-checks, and scope confirmation. 

If you’re using manual spreadsheets to transition from PCI 3.2.1 to 4, you have hundreds of hours of work ahead of you — not 100 or 200 hours, but as many as 400 hours or more. That work includes:

1. Identifying what’s new and different about PCI 4
2. Understanding what each of the new requirements means
3. Determining what you already have in place
4. Mapping your existing controls from PCI 3.2.1 to PCI 4
5. Identifying the adjustments you need to make to policies and procedures
6. Recreating your spreadsheets or other manual tracking systems
7. Building out a strategic plan for the transition
8. Assigning every task to specific individuals
9. Tracking your progress along the way
10. Reporting your progress to leadership

After all that, you still have to work with your Assessor (QSA or Qualified Security Assessor). Don’t expect it to be as quick and easy as previous years. There will probably be a good amount of back-and-forth rework as you learn the intricacies of PCI 4.

If Your Annual Assessment Is in April or May

If your next signature on an AOC is in April or May, you have an astronomical amount of work to do before the deadline. You will need to have your transition concluded, buttoned up, and in place in less than three months. That’s simply not tenable.

In that case, your best bet is to change course, get your final PCI 3.2.1 AOC signed before the deadline, and then focus your energies on transitioning for your 2025 assessment.

TCT is seeing several organizations pushing up their annual assessment date. Their scheduled assessment may be in April or May, but they’re fitting it in before the end of March so that they have a full year before their first AOC under PCI 4.

Keep in mind: if you choose to sign your AOC right before the deadline, you’ll likely place your staff under substantial pressure to be ready for an assessment in an abbreviated period of time. Operationally, your business isn’t slowing down — your people won’t have downtime that allows them to prepare for your annual assessment. Count the cost before you commit.

Related: PCI 4.0 Is Coming — Here’s What to Expect

If Your Annual Assessment Is in Q3 or Later

It’s a different kind of math problem if your AOC signature is in July or August. In that case, you are now under the gun to get your transition done in time for your annual audit. Don’t be fooled: switching to PCI 4 will take more time than you think, and six months is not a comfortable runway.

Your only option is to dedicate the resources necessary to get the transition done as quickly and efficiently as possible. 

Organizations that use manual or homegrown compliance management systems will feel the pain most. Not only will they need to recreate their systems and go through rounds of testing and revisions — they’ll also be stuck in slow, painful, manual processes.

If your next assessment is in Q4, you’re in a slightly better position, but you don’t have time to waste either. Start planning and implementing your transition to PCI 4 this month.

Use the Right Tools for a Quicker and Easier Transition

If your organization is in a pressure situation to make the PCI transition, the biggest and most important element to your success is to track and manage your status. You need to know at a moment’s glance what needs to be done, who’s doing it, and when it will get done.

Those questions are challenging to manage and track manually, but they’re readily answered when you leverage a compliance management solution. 

The difficulties of a manual system

Even if you have a homegrown system that you’ve spent years perfecting, PCI 4 will have you making a myriad of fundamental changes that could take additional years to get just right. Is your tight timeline best spent on reworking your internal systems all over again? Consider the amount of resources and indirect dollars you’ll spend on that effort, which you could be investing in your operations.

Also keep in mind that this won’t be the last major update for you to push through. PCI 4.0 will be updated with incremental updates, and eventually we’ll be anticipating PCI 5.0. Looking at the trends in cybersecurity, it could come sooner than you think.

Updating a Homegrown Compliance System for PCI 4? Better Brace for Impact!

Easier transitions with TCT Portal

TCT Portal can automatically map your existing compliance engagement from PCI 3.2.1 to PCI 4. Simply load up a 3.2.1 track into TCT Portal and spin up a PCI 4 track in seconds. The new track will automatically map to your existing items, giving you complete clarity about what’s left for you to do in your transition.

TCT Portal also has PCI 4 explanations right at your fingertips:

• The guidance from PCI is associated with each line item.
• Your Assessor’s instructions and examples are available with just a click.
• Your internal notes are right there at your fingertips.

TCT Portal compliance software dramatically shortens the ramp-up time for learning PCI DSS 4 so you can be humming along faster.

Don’t waste valuable time, effort, and operational costs on manual systems. Make the switch to an advanced compliance management system that can streamline your transition to PCI 4. You’ll save hundreds of man-hours and thousands of dollars.