PCI DSS 4.0 Is Now Mandatory: What South Florida Merchants Must Do

If your business accepts credit cards, the rules changed. The final set of PCI DSS 4.0 requirements became mandatory in 2025, and the older 3.2.1 standard is retired. Many small merchants are still running on the old assumptions, and non-compliance can bring fines that climb into the tens of thousands of dollars per month, plus liability if a breach occurs.

What actually changed

Version 4.0 pushes stronger, always-on security. Key items for smaller merchants include multi-factor authentication for anyone who can reach cardholder data, longer and stronger passwords, more rigorous vulnerability scanning, and tighter protection of the web pages where customers enter card details. The theme is moving from a once-a-year compliance scramble to security you maintain year round.

Your obligations depend on how you validate

How much applies to you depends on which self-assessment questionnaire your business uses, and those categories shifted in 2025. The safe first step is to confirm your current SAQ type and payment setup, because a change in how you accept cards can change which requirements you must meet.

A practical path to compliant

Turn on MFA everywhere, tighten passwords, run authenticated vulnerability scans, keep systems patched, and document what you do. Most of these overlap with plain good security and with what cyber insurers already expect, so the work pays off well beyond the card brands.

PCI 4.0 is not just a box to tick. It is the baseline that keeps your customers card data, and your ability to accept cards, protected.