general🌐InternationalQualys Blog
Your Guide to PCI DSS 4.0.1 Web Application & API Controls—and a Simplified Path to Compliance
Friday, December 19, 2025
What
Organizations must comply with new PCI DSS 4.0.1 requirements that enhance security measures for web applications and APIs, particularly against skimming and other application-layer attacks.
Where
Applicable to all merchants and third-party payment service providers globally.
When
Compliance is required as of April 1, 2025.
Key Factors
- •Mandatory inventory of custom software (PCI 6.3.2)
- •Risk-based vulnerability prioritization (PCI 11.3.1.1)
- •Tamper-detection controls for payment pages (PCI 11.6.1)
Takeaways
- →Organizations must modernize their security practices to meet new compliance requirements.
- →The shift towards application-layer security indicates a growing trend in cyber threats targeting web applications.
- →Implementing continuous monitoring and risk assessment is crucial for maintaining compliance.
Read Full Article
Opens original article on Qualys Blog
