Significant Change
PCIComplianceHubLast updated
A change that could affect the security of the cardholder data environment, which is how PCI DSS v4.0.1 characterises the term. The standard gives examples rather than a fixed list (new, replaced or upgraded hardware or software in the CDE, changes to network topology, segmentation or account data flows, changes to scope or to supporting infrastructure and third parties) and leaves each entity to decide, and document, which of its changes qualify. When one occurs, internal and external vulnerability scans are repeated, penetration testing is repeated for the affected infrastructure or applications, applicable requirements are confirmed in place on the changed systems, and scope is re-confirmed.
Applies to. A significant change triggers a fixed set of repeat activities. Internal vulnerability scans (11.3.1.3) and external vulnerability scans (11.3.2.1) are run again and high-risk, critical or CVSS 4.0-plus findings resolved; public-facing web applications protected by periodic review rather than an automated attack-prevention solution are re-reviewed (6.4.1); all applicable requirements are confirmed in place on the new or changed systems and documentation is updated (6.5.2); and PCI DSS scope is re-confirmed (12.5.2, and 12.5.2.1 for service providers). Service providers must also review scope and control applicability after significant changes to their organisational structure (12.5.3).
Limits. The standard does not list which changes count; the entity's own documented criteria, applied through change control, are what an assessor examines (11.3.1.3 and 11.3.2.1 look at change control documentation alongside scan reports). Routine patching and like-for-like replacement are not automatically significant.
Related. Change Control, Change Management, Scoping, Internal Vulnerability Scanning, Penetration Testing
Sources. PCI DSS v4.0.1 (June 2024)