PCI DSS v4 – Changes at a Glance

Latest update:
30 Jun
2022

After several years wait, and to surprisingly little fanfare, the Payment Card Industry Security Standards Council (PCI SSC) released the new version of the PCI Data Security Standard (DSS) on 31 March 2022.  It has been 4 years since the last minor update (v3.2.1) and nearly 9 years since the last major update (v3.0).  Given the ever evolving risks and changes in the security landscape and technologies, it can be argued that the new release is long overdue.  The question is, what has changed and why is this classified as a major update?  So, here’s a brief summary of the key changes.

The Requirements

There have been a lot of minor clarifications, renumbering, and rearranging of the requirements within the Standard to make it flow better and easier to follow.  But there are also approximately 40 new requirements across a variety of areas including:

  • Increased requirements for multi-factor authentication across the scope
  • New requirements mandating the deployment of anti-phishing systems
  • Greatly expanded risk assessment requirements
  • Mandatory deployment of a web application firewall (WAF) for public-facing web applications
  • Change detection on HTTP headers of payment pages.

Customised Validations

This, in URM’s opinion, is what makes this update a major change.  The Council has introduced a completely new way for organisations to validate their PCI compliance status, calling it a ‘customised validation’.  Simply put, this is a new way to meet the intent of any given requirement, but with a control that you design and implement.

This provides your organisation with the flexibility to meet a requirement in a way that best suits you, however, it is not without its drawbacks.  A customised validation requires a great deal of effort from your organisation to design, document, detail, test, and maintain controls, much of which relies on you having a mature risk assessment process embedded within your operations and processes.

In short, customised validations are not for the faint hearted and require a significant resource investment to accomplish correctly, not to mention the increased level of effort required by your QSA to assess each customised validation as being compliant.

Additional Resources

On 7 April 2022, URM held a webinar that outlined some of the key changes within version 4 of the Standard and the implications of those changes. If you would like to access a recording of this webinar, please complete the form below and we will email you a link at the earliest opportunity, i.e. during normal office hours – Monday to Friday, 9 to 5:30.

On 7 April 2022, URM held a webinar that outlined some of the key changes within version 4 of the Standard and the implications of those changes.
Information Security
updateD:
30/6/2022
PCI DSS v4 – Changes at a Glance

After several years wait, and to surprisingly little fanfare, the Payment Card Industry Security Standards Council (PCI SSC) released the new version of the PCI Data Security Standard (DSS)…

Read more
Information Security
updateD:
30/6/2022
PCI SSC Remote Assessment Guidelines and Procedures

The PCI SCC has recently released a new remote assessment guidelines and procedures. Here we address a number of key questions: What are the Main Contents? What Led to it Being Published? And others..

Read more
"
Cyber Essentials Plus was a great exercise for the business to go through as some gaps were found and URM provided valuable information on remediation
contact US

Let us help you

Let us help you in your compliance journey by completing the form below and letting us know how we can best support you
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.