PCI DSS v4.0.1 – the current active version as of 2025 – includes Requirement 6, which directly addresses secure software development and vulnerability management. It requires organizations to analyze code for security vulnerabilities and remediate them before releasing software to production.
A code audit supports these requirements by identifying injection flaws, insecure authentication patterns, hardcoded credentials, and other vulnerabilities that could expose cardholder data. It also helps you maintain the software inventory that PCI DSS 4.0 now requires. Non-compliance penalties can range from $5,000 to $100,000 per month, depending on transaction volume and how long the gap goes unaddressed.
Reference
PCI DSS Document Library – PCI Security Standards Council – pcisecuritystandards.org