What it requires
- Have an approved scanning vendor scan the online payment page at least every three months, even for the shortest questionnaire.
- Confirm once a year which systems the standard covers.
- Install fixes for critical flaws within 30 days.
Who it applies to
Healthcare, nonprofits and schools & libraries.
120,816 exempt organisations in the 22 counties.
IRS exempt list · 2 Oct 2026The project that meets it
Sources
PCI DSS 4.0.1 is in force.
David from SBK replies within one working day.