# PCI DSS 4.0.1: Future-Dated Controls and Backup Evidence

> PCI DSS 4.0.1 future-dated requirements are now mandatory. Here is what every QSA wants to see for backup, restore, and integrity controls, and what auditors flag most often.

Source: https://loopbackup.com/blog/pci-dss-4-0-1-future-dated-controls-backup
Publisher: Loop Backup
Content language: en

---

## At a Glance

PCI DSS 4.0.1 replaced 4.0 in June 2024. The transition deadline from 3.2.1 expired in March 2024, and the **future-dated requirements** became mandatory on **31 March 2025**. Every assessment from that date onwards is being scored against the full ruleset.

The most common cause of a failed assessment in 2026 is not the new authentication or scripting rules, it is **insufficient backup and recovery evidence**.

## What 4.0.1 requires for backups

Several requirements touch backup and restore directly:

- **Requirement 9.4**, secure media handling and offline storage of backups
- **Requirement 12.10**, incident response plan that includes recovery procedures
- **Requirement 6.5**, change management evidence covering backup configurations
- **Requirement 10**, audit logs for backup access, retained for at least 12 months (3 months immediately available)

The new "Customised Approach" lets you propose alternative controls but the **objective evidence** bar is high: documented restore tests, log retention, and chain-of-custody.

## What auditors flag most often

1. No documented restore test in the last 12 months
2. Backup admin accounts shared between operators
3. No segregation between production credentials and backup credentials
4. Backups stored in the same blast radius as production
5. No integrity check on restored data

## How [Loop Backup](/) helps

[Loop Backup](/cloud-backup-for-business) ships with immutable backups, per-operator audit logs, role-based admin access, and one-click restore-test reports that satisfy QSAs. See [Why a separate backup access matters](/why-separate-backup-access).

## Bottom line

PCI DSS 4.0.1 is no longer "coming soon", it is being assessed today. If your last documented restore test is over a year old, you are already non-compliant.