Author: Viviana Wesley, PCI QSA
The PCI Security Standards Council has published a change highlights document for v3.0 expected in November 7th 2013.
According to the PCI SSC, these changes are intended to address the maturity of the industry since 2006. Lack of education and awareness coupled with poor implementation and maintenance are leading causes of breaches today; this update is intended to target these challenges by providing guidance and clarification on the intent of requirements and how to meet them.
V3.0 will introduce more changes than v2.0 did. There are still 12 security areas, but the new versions of the data security standards will include several new sub-requirements. Recognizing this as a challenge, the SSC will identify some of the sub-requirements as best practice only until July 2015. Additionally, v2.0 will remain active until December 31, 2014.
Per the PCI SSC, “this document is for advance informational purposes only and does not replace the current versions of PCI DSS and PA-DSS, the to-be-published detailed Summary of Changes, or Version 3.0 of the Standards.” “These proposed updates are still under review by the PCI community. Final changes will be determined after the PCI Community Meetings and incorporated into the final versions of the PCI DSS and PA-DSS published in November.”
Visit the PCI SSC document library and obtain a copy of the change highlights for your review.
Contact HALOCK to discuss the upcoming changes and how you can prepare your organization for v3 compliance obligations.