Key Updates in PCI DSS 4.0

From 31st March 2025, all organisations must ensure they are fully prepared to meet the updated compliance standards and implement the necessary security controls. PCI DSS 4.0 introduces several enhancements designed to strengthen security measures, provide flexibility in security approaches, and improve validation processes. Some of the key updates include:

• Proactive Risk Assessment: A more rigorous approach to risk assessment and security control evaluations.
• More Frequent Audits: Regular documented reviews of sensitive authentication data security.
• Stronger Protection Against Cyber Threats: Enhanced safeguards against malware, phishing, and social engineering attacks.
• Security Awareness & Training: Expanded requirements for security awareness programmes to ensure all personnel understand and uphold security best practices.
• Stronger Authentication & Password Requirements:
  • Multi-factor authentication (MFA) is now required across more system components.
  • Minimum password length increased from 8 to 12 characters.
  • Well-documented encryption protocols must be in place.
  • Clearly defined roles and responsibilities for security measures.

What is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a set of information security standards established by major credit card companies, including Visa, Mastercard, Discover Financial Services, American Express, and JCB. Managed by the Payment Card Industry Security Standards Council (PCI SSC), this framework is designed to protect credit and debit card transactions from data breaches and fraud.

PCI DSS certification validates an organisation’s compliance with these security standards, reinforcing trust and ensuring the secure handling of payment card data. Certification requires completing a self-assessment questionnaire and passing a PCI compliance scan to assess the security of systems and processes. To enhance accountability, Elovate employs an external Qualified Security Assessor (QSA) to independently validate compliance each year.

With its robust guidelines, PCI DSS plays a crucial role in safeguarding cardholder data, particularly during transmission, providing organisations with a framework to create and maintain secure payment card environments that effectively detect and mitigate threats.

Why PCI DSS Matters to Elovate

Alastair Fell, Commercial Director at Elovate, explains:

“As digital payments grow, so do the risks of attacks targeting cardholder data. Every transaction processed by our contact centre, digital mailroom, or online platforms is a potential point of vulnerability within the digital payments infrastructure. With businesses increasingly integrating payment systems with cloud technologies and IoT devices, the stakes have never been higher. Addressing these risks requires a comprehensive security framework—this is where the Payment Card Industry Data Security Standard (PCI DSS) is essential to Elovate. Ensuring PCI compliance is critical for businesses handling card transactions, and at Elovate, we recognise our responsibility in protecting both consumers and donors from payment card-related fraud.”

How Elovate Invests in PCI DSS Compliance

Achieving and maintaining PCI DSS compliance requires ongoing investment in security measures, technology, and best practices. Elovate takes a proactive approach by implementing the following:

• Internal Audits: Regularly conducting audits and in-depth assessments to monitor cardholder data storage and security policies, identifying and addressing any compliance gaps.
• Patch Management: Implementing a continuous patch management programme to detect vulnerabilities, apply updates promptly, and maintain compliance documentation.
• Automation & Threat Monitoring: Leveraging automation tools and maintaining a 24/7 manned Security Operations Centre (SOC) to detect and respond to potential security threats in real-time.
• Employee Training & Awareness: Conducting regular training sessions for employees on data security best practices, compliance procedures, and real-world security challenges.

A Commitment to Secure Transactions

Elovate’s certification for PCI DSS 4.0 underscores its commitment to maintaining the highest level of security in payment processing. By continually investing in cybersecurity measures, compliance protocols, and employee training, Elovate ensures that its clients, donors, and consumers can trust that their payment data is handled with the utmost care and protection.

As the digital payments landscape evolves, Elovate remains dedicated to staying ahead of security threats, upholding industry-leading standards, and providing a secure environment for financial transactions.

Back to Stories