PCI DSS 4.0: Why Staff Training is Key to Compliance

The Payment Card Industry Data Security Standard, PCI DSS v4.0 transition to the new standard became fully effective on 31 March 2025, after PCI DSS 3.2.1 was retired on 31st March 2024. All UK businesses that handle payment card data must follow the new requirements starting from 31 March 2025 as non-compliance will result in penalties, higher transaction fees and potentially lead to card payment processing termination.

PCI DSS compliance serves as a requirement, not law, for UK businesses because card schemes (Visa, Mastercard, Amex, etc.) enforce it through their acquiring banks. Organisations that fail to meet PCI DSS standards will face penalties and contract violations and experience major harm to their reputation. The requirements of PCI DSS match UK data protection regulations, which include the UK GDPR and Data Protection Act 2018, so organisations must comply for both commercial and regulatory purposes.

Why PCI DSS 4.0 Matters to the UK

1. The use of e-commerce and contactless payments by UK consumers has made card data security an essential factor for preserving customer trust.
2. The industry-based PCI DSS framework provides security controls that fulfill UK GDPR Article 32 requirements for processing security and help organisations decrease their exposure to liability when a breach occurs.
3. The UK National Cyber Security Centre (NCSC) frequently publishes information about phishing attacks, web skimming incidents and ransomware threats, which PCI DSS 4.0 provides protection against.
4. UK businesses depend on cloud hosting services, payment processing solutions and managed IT support from third-party providers. PCI DSS 4.0 requires organisations to enhance their oversight of third-party service providers, which means changes to their vendor management practices and contract development.

Major Changes Relevant to UK Businesses

1. Multi-Factor Authentication (MFA)
   MFA has become mandatory for all users who need to access the cardholder data environment (CDE). The new requirement follows the security standards of the National Cyber Security Centre, NCSC, Cyber Essentials Plus scheme for UK businesses.
2. Password & Authentication Policy Updates
   The password requirements now demand longer passwords, but organisations can bypass these rules when using phishing-resistant authentication methods or password-less authentication systems.
3. Stricter Web Application Security
   All public payment pages need automated protection through Web Application Firewalls to prevent unauthorised access. The execution of customer browser scripts for checkout operations requires authorisation and monitoring systems to prevent Magecart-style attacks (a type of cyberattack that targets e-commerce sites by injecting malicious code into checkout pages, allowing threat actors to “skim” user credit card details put into the HTML form), which have targeted UK retailers.
4. Phishing Protection
   The new requirements exist for phishing detection systems, technical security measures and employee phishing awareness training. The UK faces a high number of breaches due to phishing attacks, so this requirement becomes essential.
5. Scope Confirmation
   The PCI DSS scope needs annual verification, but third-party provider use requires an additional detailed assessment. The requirement matches the UK regulatory focus on supply chain risk management, which the NCSC and FCA have identified.
6. Encryption Rules
   The protection of stored card data through disk-level encryption no longer fulfills PCI DSS requirements except when data is stored on removable media. Organisations in the UK need to evaluate their current methods for encrypting cardholder data when it remains in storage and when it moves between systems.
7. Third-Party Service Provider Oversight
   UK merchants need to verify that their cloud providers, payment gateways and IT service firms maintain PCI compliance while keeping records of their shared security responsibilities. The requirement applies specifically to the UK because it depends heavily on external IT service providers.

Staff PCI DSS 4.0 Training

PCI DSS 4.0 requires that security awareness and role-specific training be regular, documented, and practical. UK organisations should link training to real-world risks like phishing, insider threats, and third-party compromises. The goal isn’t just compliance but embedding security into daily behaviour.

PCI DSS 4.0 Staff Training Recommendations

1. Security Awareness Training for All Employees – well served by online training
   • All staff members who interact with cardholder data or operate within the Cardholder Data Environment (CDE) must receive annual (minimum) training.
     The training program should include:
     • Information about what PCI DSS is and its significance for compliance
     • Cardholder data handling protocols and sensitivity rules
     • Methods to identify security incidents and data breaches
     • Incident reporting procedures.
   • The main reason behind data breaches stems from human mistakes. All staff members need training because it teaches them how to protect payment data, even though they do not work in IT.
2. Role-Specific Training – well served by practical on-the-job training
   • Tailored content depending on job role for:
     • Developers
     • Customer service teams
     • System administrators
   • The training needs to demonstrate actual job-specific risks because PCI DSS 4.0 operates as an outcome-based standard.
3. Phishing Awareness & Social Engineering Defence – well served by online training
   • PCI DSS 4.0 emphasises phishing controls and the UK’s NCSC reports phishing attacks as the leading security threat. Payment card environments face the highest risk of credential theft because of their status as primary targets.
   • The organisation should run regular simulated phishing email exercises and train staff members to identify phishing attempts, phone scams and social engineering tactics.
4. Password & Authentication Practices – well served by online training
   • The organisation should train employees about the new password requirements, which include longer passphrases, Multi-factor Authentication, MFA, activation and password non-reuse policies.
   • The new authentication standards in PCI DSS 4.0 require staff to follow these rules because weak authentication points, such as shared passwords and written-down passwords, need to be eliminated.
5. Incident Response & Reporting Training – well served by in-house training
   • Organisations must follow PCI DSS requirements to establish and test incident response plans for security incidents. A fast and accurate response to security incidents helps organisations reduce the extent of breaches while preventing penalties from regulatory bodies.
   • Staff members need to receive training about:
     • How to identify security incidents through signs such as unexplained login activity, unusual checkout scripts and data disappearance.
     • Their reporting procedures and the required speed of notification to IT/Security teams.
     • Their specific responsibilities within the organisation’s incident response plan.
6. Third-Party & Remote Work Risks – well served by online training
   • PCI DSS 4.0 now requires organisations to monitor third-party vendors more closely because staff members tend to be the primary vulnerability when dealing with external systems.
   • Training should focus on secure data management practices, which employees need to follow when using third-party tools, service providers, working remotely through VPN connections and secure Wi-Fi networks, and should avoid local downloads of sensitive information.
7. Regular Refreshers & Testing – well served by online training
   • The process of compliance requires ongoing awareness because it extends beyond single audit exercises. Security culture needs ongoing support from training programmes, which go beyond basic compliance requirements.
   • The training programme should include continuous awareness training, refresher courses and assessment of knowledge retention through short quizzes and practical simulations.

The Business Case for PCI DSS 4.0 Training

• The human factor in breaches as most involve human error or social engineering
• Regulatory alignment – training demonstrates “appropriate organisational measures”, reducing liability if a breach occurs
• Audit evidence – training logs, attendance records and content of training
• Culture of security – training establishes a security-first mindset in staff
• Incident cost reduction – training can cut breach response times, reducing fines, reputation and financial losses.

Conclusion

PCI DSS 4.0 is the most substantial payment card security requirement update in the last decade. Businesses need to take action for compliance as it protects their ability to process cards and safeguards customer trust, while minimising regulatory exposure. PCI DSS compliance serves as an opportunity for businesses to build enhanced security against the most dangerous cyber threats that affect the UK right now.

You may also be interested in:
Data (Use and Access) Act 2025 (DUAA): What’s New?
Employment Law Changes: Are your Staff Trained?
Preventing Sexual Harassment: Is your Business Compliant?
Failure to Prevent Fraud: Are your staff trained and ready?
Simpler Recycling Regulations: Challenges and Opportunities

Author: Carolyn Lewis
1/7/25

Sources:
IT Governance
Linford & Co
PCI Security Standards Council