Future-Dated Requirement
PCIComplianceHubLast updated
A requirement published in PCI DSS v4.0 but marked as a best practice until 31 March 2025, giving organizations time to plan and budget for it before it was assessed. Future-dated requirements were not tested for compliance before that date. All of them are now in force: since 31 March 2025 every v4.x requirement is mandatory and assessed like any other. The label still appears in v4.0 documents and older guidance, so treat it as historical context rather than a live exemption.
Applies to. Since 31 March 2025 there are no future-dated requirements left; an assessment against v4.0.1 tests every requirement in full. The label still matters when reading older material: v4.0 documents, and some text carried into v4.0.1, mark certain items as 'a best practice until its effective date', for example the change- and tamper-detection mechanism for payment pages and its place in the incident response plan. Treat any such marking as expired.
Limits. A v4.0.1 assessment cannot record a formerly future-dated requirement as 'best practice' or 'not yet tested'; it is in place, not in place or not applicable like any other requirement.