Webinar recording: Achieving compliance with PCI DSS V4.0 now that v3.2.1 has been retired
Pete Woodward, CEO and Co-founder, delivered a webinar last month to help organisations understand how best to achieve and maintain compliance with PCI DSS V4.0 now that v3.2.1 has been retired.
Pete has been a PCI Payment Card Industry Qualified Security Assessor (or QSA) for many years. That means Pete is one of only a very small number of people worldwide qualified to perform Payment Card Industry compliance audits and consultancy and has worked with many organisations to help them achieve and maintain PCI compliance.
Here is a recording of the session with an article summarising the webinar below:
Changes in PCI DSS V4.0
Emphasis on Security
PCI DSS V4.0 focuses heavily on meeting the security needs of the payment card industry, particularly in securing cardholder data environments. This reflects changes in technology and security controls, ensuring they are up-to-date with current threats.
Multi Factor Authentication
One of the major updates is the expansion of multifactor authentication requirements. Previously, this was only mandatory for admins, but now it applies to any access to the cardholder data environment.
Password Policies
Password policies have also been updated. The minimum password length is now 12 characters, up from the previous seven. There are exceptions if systems cannot handle longer passwords, allowing a fallback to eight characters.
Ecommerce and Phishing Requirements
New ecommerce and phishing requirements have been introduced, including file integrity monitoring services for ecommerce platforms. This ensures ongoing security, emphasising that protection should be continuous, not just at a single point in time.
Roles and Responsibilities
An immediate change in PCI DSS V4.0 is the clear assignment of roles and responsibilities within your organisation. This includes specific tasks like internet connection security and database protection. The goal is to ensure that everyone understands their part in maintaining the security of cardholder data.
Reporting and Flexibility
PCI DSS V4.0 introduces more transparent reporting with improved front-loaded scope details and diagrams. It also offers flexibility in achieving security objectives, such as allowing shared or group accounts in certain emergency situations, provided there’s a clear risk assessment and justification.
Risk Management
PCI compliance now integrates more closely with your organisation’s risk management methodologies. This includes targeted risk analysis, empowering you to apply specific risk controls around sensitive information and payment card data.
Customised Approach
A new approach to completing assessments is the “customised approach.” This method is intended for organisations with extensive PCI compliance experience, allowing for a more strategic implementation of security objectives.
Validation and Assessment
Validation requirements have increased, emphasising a clearer alignment between information gathered and reports on compliance or self-assessment questionnaires. This ensures a more informed understanding of the PCI compliance status for all parties involved.
Logging and Monitoring
PCI DSS V4.0 moves towards automated mechanisms for log reviews, reducing the risk of errors in manual checks. This shift is crucial for detecting anomalies and maintaining continuous security.
Common Blockers and How to Address Them
Roles and Responsibilities
Many organisations overthink the assignment of roles, worrying about job reapplications. Instead, focus on defining roles by function within the organisation, particularly regarding cardholder data responsibilities.
Technical Controls
The new technical controls, especially those for ecommerce platforms, can be confusing. Vendors are slowly introducing solutions, but understanding and implementing these requirements remain challenging.
When using service providers, ensure you have a clear shared responsibilities matrix that aligns with the attestation of compliance. This document clarifies who is responsible for what in terms of cardholder data security.
Targeted Risk Analysis
Align your PCI compliance with your internal risk methodologies. This targeted approach allows flexibility in applying security controls specific to PCI requirements.
Action Plan
- Assess Your Current State: Understand where you stand with version 3.2.1 and what needs updating.
- Create a Roadmap: Plan your transition to PCI DSS V4.0 with clear goals and timelines.
- Utilise Available Resources: Make use of the new free tools and guidance available to you.
How We Can Help
We offer various services to assist you through this transition, including audits, actionable plans, and expert guidance from experienced QSAs. We’ve also just launched our new free PCI DSS V4.0 readiness assessment tool, designed to help you quickly evaluate your preparedness and receive personalised feedback.
Free PCI DSS PCI DSS V4.0 Readiness Assessment
Our readiness assessment is a quick, free tool that takes about five minutes to complete. It includes 15 high-level questions about your environment and provides a personalised report with feedback tailored to your specific needs. The results will help you understand your readiness and highlight areas that might need more focus.
There is a lot changing with PCI DSS V4.0, and it’s crucial to get up to speed and act now. Use our new assessment tool to gauge your readiness and keep in touch with us for any assistance you may need.
Q&A Highlights
What if we’re not ready by our compliance deadline?
- Generally, a 90-day grace period is allowed if you’re actively working with a QSA or similar organisation.
Is there any flexibility if we can’t meet a requirement, like the password minimum length?
- Compensating controls can be used if they provide an equivalent level of security or more.
Do you need to segment your network to be compliant?
- Network segmentation is not required but highly recommended to reduce scope and risk.
Does PCI DSS V4.0 take longer than 3.2.1?
- Yes, it typically requires more input and effort due to additional requirements and detailed validation processes.
If you have any questions or need further assistance, please don’t hesitate to reach out to us using the contact form below.