New Version Of PCI Compliance Guidelines Released

PCI 3.0 changes focus on compliance as a business-as-usual process, rather than a snapshot

The Payment Card Industry (PCI) Security Standards Council (SSC) Thursday released PCI 3.0, the latest version of the councils security compliance requirements for businesses that accept credit and debit cards.
Available now on the
PCI SSC website
(PDF), version 3.0 becomes effective on Jan. 1. Version 2.0 will remain active until Dec. 31, 2014, to ensure adequate time for organizations to make the transition.
Many of the key changes to the guidelines are designed to make compliance more of a regular process, rather than a report on a companys compliance at a specific point in time, according to the council and other experts.
Version 3.0 will help organizations make payment security part of their business-as-usual activities by introducing more flexibility, and an increased focus on education, awareness and security as a shared responsibility, the PCI Council says. Overall updates include specific recommendations for making PCI DSS part of everyday business processes and best practices for maintaining ongoing PCI DSS compliance; guidance from the Navigating PCI DSS Guide built in to the standard; and enhanced testing procedures to clarify the level of validation expected for each requirement.
PCI DSS is stressing that their compliance standard is not a set-it-and-forget-it mentality, says Joe Schumacher, security consultant at Neohapsis, which helps enterprises with PCI assessment.
Some important areas in this new mentality focus on security processes, Schumacher says in a
blog
. For example, entities should be validating on their own that controls are implemented effectively for applicable businesses processes and related technologies. Some specific examples related to this new mentality focus on antivirus definitions, logging, vulnerability signatures and ensuring that only appropriate services are enabled on systems.
With this new mentality, entities should look to take corrective actions when compliance gaps are identified so that PCI DSS compliance can be maintained at all times and not wait until their [auditor] comes to validate their compliance.
Some experts said the new guidelines dont go far enough.
Overall, the council has made some excellent improvements to the standard, but the risk management area of PCI 3.0 still needs more work, says Michael Aminzade, director of compliance delivery at Trustwave. The main area of concern is that even though the new standards reference risk management strategies that must be met, the standard doesnt enforce companies to adopt any of those strategies. In particular, the standard doesnt address the fact that risk assessments need to be done by an industry-certified professional and are only performed on an annual basis. Also, PCI DSS 3.0 does not include any changes surrounding mobile security.
Have a comment on this story? Please click Add a Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New Version Of PCI Compliance Guidelines Released