--- title: PCI DSS 4.0 and the Changing Approach to Compliance description: PCI DSS 4.0 and data driven technology are changing the way we approach compliance. How can businesses adapt? image: https://insights.comforte.com/hubfs/blog%20header%20compliance%20red%20binder.jpg --- [![Hubspot_blog_logo](https://insights.comforte.com/hs-fs/hubfs/Hubspot_blog_logo.png?width=295&name=Hubspot_blog_logo.png)](http://www.comforte.com) [![Subscribe](https://no-cache.hubspot.com/cta/default/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0) [![pci compliance](https://insights.comforte.com/hubfs/blog%20header%20compliance%20red%20binder.jpg)](https://insights.comforte.com/pci-dss-4.0-and-the-changing-approach-to-compliance) [Dan Simmons](https://insights.comforte.com/author/dan-simmons) l Sep 10, 2020 l [PCI DSS](https://insights.comforte.com/tag/pci-dss), [Data Protection](https://insights.comforte.com/tag/data-protection), [Compliance](https://insights.comforte.com/tag/compliance), [Cloud Computing](https://insights.comforte.com/tag/cloud-computing) # PCI DSS 4.0 and the Changing Approach to Compliance In the past, the focus of PCI compliance was to store as little sensitive data as possible and keep it secured. In today's data driven world, that focus has changed.  Architectural and system alterations, new privacy regulations, and the need to maximize the use and consumption of data are all driving factors behind the major changes that we have seen lately. All of these factors driving industry-wide evolution can be traced to one simple notion: **data is the new gold, and organizations want to monetize it.** If you look at the world of PCI DSS over the past 10 years, tokenization emerged as a technology to reduce risk and compliance scope. The previous philosophy was to remove any data that was not needed and protect what little data you keep. However, fast forward to the modern day, organizations are thinking about digital transformation and their assets that will equip them to compete with competitors, and data is at the heart of nearly every business decision made. Therefore, organizations must answer the questions: - How do we balance data collection and the associated risks? - How do we make sure we are getting the maximum utility from data if it is sensitive in nature? ## PCI DSS 4.0 [PCI DSS 4.0 is emerging](https://blog.pcisecuritystandards.org/pci-dss-looking-ahead-to-version-4.0) and organizations have to prepare for its impending arrival. This preparation, if not taken seriously, will present a challenge, especially with regards to legacy PCI DSS technologies. PCI DSS 4.0 demands a more continuous assessment and risk management strategy. This will be very different to how PCI started which was very much point in time assessments. This means you could be compliant one day and potentially be penalized the next if there is not a continuous risk strategy in place. Another issue that will arise due to PCI DSS legacy controls and systems is they have agility limitations that will eventually impede organizations that want to migrate to more agile architectures, for instance modern cloud native architectures. Recently, we've seen container application architectures emerge, new types of stacks, new ways to orchestrate and build applications. This has seen many organizations undertaking digital transformations at a fundamental level to allow them to be more agile, to compete with new emerging start-ups, and to build and adapt to market conditions. As an aside, the COVID-19 scenario is a prime example of a very difficult unpredictable market change that impacted the world and resulted in organisations having to accelerate further their ability to respond to these conditions with regards to risk and data - agile methods are absolutely critical to that. On top of all that, we have [privacy regulations](https://insights.comforte.com/13-countries-with-gdpr-like-data-privacy-laws?hsLang=en) in addition to classic regulatory environments like PCI DSS. These are applying new pressures on organisations wanting to stay compliant while utilizing sensitive data. Furthermore, with the emergence of Big Data, machine learning and AI, more power is being leveraged by organisations, but these will bring about new privacy and security risks as well. So there are many factors contributing to the heaps of sensitive data that organizations are amassing and at the same time there are more and more standards and regulations emerging that govern the way that that data has to be handled. Remember, there are two parts to the data protection formula: keep only the sensitive data you need and *protect what you keep*. If you're going to keep more sensitive data for analytics and other business cases, then as before you have to protect it. Tokenization can be the  key to this balancing act.  ## Tokenization is the key (with no need for key management!) ![tokenizaiton is the key](https://insights.comforte.com/hs-fs/hubfs/Stock%20images/Close%20up%20of%20human%20hand%20holding%20golden%20key.jpeg?width=230&name=Close%20up%20of%20human%20hand%20holding%20golden%20key.jpeg)Out of all the data security solutions on the market, the best way to protect sensitive data and enable analytics is through tokenization. This is done by substituting a sensitive data element (e.g. a name, address, or D.O.B) with a non-sensitive equivalent (known as a token). By tokenizing critical data, those that wish to carry out data analytics are able to extract insights without the risk of exposing personal, confidential data. This eliminates one of the prime issues with classic security solutions which are unable to fully protect sensitive data throughout its entire lifecycle. For instance, data that is protected with classic encryption has to be deciphered and thereby exposed before analytics can be performed. Not so with tokenization. Analytics can be performed on tokenized data while they are still in a protected state. Should a third-party stumble across this tokenized information, it will be worthless as any identifiable information would be replaced. An additional advantage of tokenization is that it eliminates the need for key management, as with classic encryption. This helps avoid a large vulnerability associated with encryption and saves the time and resources that key management requires.  Tokenization has long been used to fulfill key requirements of PCI DSS by [taking sensitive data out of scope](https://insights.comforte.com/3-benefits-of-taking-data-out-of-pci-audit-scope?hsLang=en). It is the preferred data protection method of many [banks](https://www.comforte.com/fileadmin/Collateral/SS_Leading_Canadian_bank_achieves.pdf), [financial institutions](https://www.comforte.com/fileadmin/Collateral/SS_Global_Payment_Service_Provider.pdf), and [retailers](https://www.comforte.com/resources/success-story-one-of-the-worlds-largest-fashion-retailers-chooses-tokenization) across the globe, both big and small. Its superior level of protection coupled with low impact on IT systems makes it the ideal form of data protection for organizations that need to both protect and process large volumes of data. --- | Share this:  | [![LinkedIn](https://insights.comforte.com/hubfs/Social%20Icons/linkedin%20icon.png)](https://www.linkedin.com/shareArticle?mini=true&url=https://insights.comforte.com/pci-dss-4.0-and-the-changing-approach-to-compliance&utm_medium=social&utm_source=linkedin) | [![Bluesky](https://insights.comforte.com/hubfs/Social%20Icons/bluesky_logo.png)](https://bsky.app/intent/compose?url=https://insights.comforte.com/pci-dss-4.0-and-the-changing-approach-to-compliance&utm_medium=social&utm_source=Bluesky) | ![Twitter](https://insights.comforte.com/hubfs/Social%20Icons/twitter_x_logo-1.png) | [![XING](https://insights.comforte.com/hubfs/Social%20Icons/xing-color2.png)](https://www.xing.com/spi/shares/new?url=https://insights.comforte.com/pci-dss-4.0-and-the-changing-approach-to-compliance&utm_medium=social&utm_source=xing) | [![Email](https://insights.comforte.com/hubfs/Social%20Icons/email%20icon.png)](mailto:?subject=Check%20out%20https://insights.comforte.com/pci-dss-4.0-and-the-changing-approach-to-compliance&utm_medium=social&utm_source=email%20&body=Check%20out%20https://insights.comforte.com/pci-dss-4.0-and-the-changing-approach-to-compliance&utm_medium=social&utm_source=email) | | --- | --- | --- | --- | --- | --- | ## Want to know how to perform analytics on protected data? Valuable data is often kept locked away because it may contain sensitive elements, which can stop data analytics in its tracks. Download our white paper and find out how to perform analytics on protected data, allowing you to gain valuable insights while avoiding data exposure: [![Download White Paper](https://no-cache.hubspot.com/cta/default/4026697/ce3f06cf-2808-4a7f-b75f-c53126c48a70.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/ce3f06cf-2808-4a7f-b75f-c53126c48a70) ### Related posts ![PCI DSS 4.0 and comforte TAMUNIO: The Case for Tokenization](https://insights.comforte.com/hubfs/comforte%20AG_PCI%20DSS%204.0%20and%20comforte%20TAMUNIO%20The%20Case%20for%20Tokenization.png) Aug 6, 2026 l [PCI DSS](https://insights.comforte.com/tag/pci-dss) , [Financial Services](https://insights.comforte.com/tag/financial-services) ### [PCI DSS 4.0 and comforte TAMUNIO: The Case for Tokenization](https://insights.comforte.com/pci-dss-4.0-and-comforte-tamunio-the-case-for-tokenization?hsLang=en) The PCI Security Standards Council (SSC) has always sought industry feedback to help shape its Data Security Standard (DSS). That’s why the latest iteration offers more flexibility for complying organizations. However, greater flexibility doesn’t... [Read more](https://insights.comforte.com/pci-dss-4.0-and-comforte-tamunio-the-case-for-tokenization?hsLang=en) ![How Vaultless Tokenization Works in Practice, to Transform Your Business](https://insights.comforte.com/hubfs/comforte%20AG_How%20Vaultless%20Tokenization%20Works%20in%20Practice%20to%20Transform%20Your%20Business_24.07.2025.png) Jul 24, 2025 l [PCI DSS](https://insights.comforte.com/tag/pci-dss) , [Compliance](https://insights.comforte.com/tag/compliance) ### [How Vaultless Tokenization Works in Practice, to Transform Your Business](https://insights.comforte.com/how-vaultless-tokenization-works-in-practice-to-transform-your-business?hsLang=en) In last month’s [blog post](https://insights.comforte.com/is-pci-dss-4.0-slowing-you-down-heres-how-comforte-can-accelerate-your-pci-compliance-journey?hsLang=en) we explained how vaultless tokenization can transform PCI DSS 4.0 compliance from a regulatory burden into a business enabler. Not only does vaultless tokenization reduce the scope and cost of compliance, but it also... [Read more](https://insights.comforte.com/how-vaultless-tokenization-works-in-practice-to-transform-your-business?hsLang=en) ![Is PCI DSS 4.0 Slowing You Down? Here’s How comforte Can Accelerate Your PCI Compliance Journey](https://insights.comforte.com/hubfs/comforte%20AG_Is%20PCI%20DSS%204.0%20Slowing%20You%20Down_%20Heres%20How%20comforte%20Can%20Accelerate%20Your%20PCI%20Compliance%20Journey%20.png) Jun 26, 2025 l [PCI DSS](https://insights.comforte.com/tag/pci-dss) , [Compliance](https://insights.comforte.com/tag/compliance) ### [Is PCI DSS 4.0 Slowing You Down? Here’s How comforte Can Accelerate Your PCI Compliance Journey](https://insights.comforte.com/is-pci-dss-4.0-slowing-you-down-heres-how-comforte-can-accelerate-your-pci-compliance-journey?hsLang=en) With the latest version of PCI DSS, the Payment Card Industry Security Standards Council (PCI SSC) aims to elevate the standards for cardholder data (CHD) security with themes like stronger cryptography, multi-factor authentication, and continuous... [Read more](https://insights.comforte.com/is-pci-dss-4.0-slowing-you-down-heres-how-comforte-can-accelerate-your-pci-compliance-journey?hsLang=en) ### Service - [Contact](https://www.comforte.com/contact/) - [About us](https://www.comforte.com/company/) - [Blog](https://insights.comforte.com/) - [Press Releases](https://www.comforte.com/company/press-releases/) - [Career](https://www.comforte.com/company/career/) - [Resources](https://www.comforte.com/resources/) ### Germany comforte AG Abraham-Lincoln-Str. 22 65189 Wiesbaden Germany Phone: + 49 611 93199 00 Fax: + 49 611 93199 05 ### Australia comforte PTY Suite 20, 1 Rivett Road North Ryde NSW 2113 Australia Postal Address: PO Box 1710 Lane Cove NSW 1595 Australia Phone: +61 2 8197 0272 ### USA comforte Inc. 30 Wall Street, 8th Floor New York, NY 10005-2205 USA Phone: +1-646-438-5716 ### Singapore comforte Asia Pte. Ltd. 1 Raffles Place, #19-61 Tower 2  Singapore 048616 Phone: +65 6808 5507 - [Sitemap](https://www.comforte.com/sitemap/) - [Legal Notice](https://www.comforte.com/legal-notice/) - [Privacy Policy](https://www.comforte.com/privacy-policy/) © comforte AG 2026