PCIDSS 4.0 from PCIDSS 3.2.1- Part 1

Written by Kiran Murthy & Eishu Richhariya

Introduction

PCI-DSS stands for Payment Card Industry Data Security Standard. This standard first came into the picture in 2004, and it was formed by Visa, MasterCard, Discover Financial Services, JCB International, and American Express. It is governed by PCI SSC, i.e., Payment Card Industry Security Standards Council.

Applicability– PCI-DSS applies to companies/organization which accepts, store, process and/or transmits cardholder data.

When will the new version PCIDSS v4.0 take effect?

Until March 31, 2024, PCI assessments will choose the version (v3.2.1 or v4.0) for conducting the assessment. After this date, v3.2.1 will be retired, and v4.0 will become the singular standard.

PCI-DSS v4.0 New Requirements

The new version contains a substantial number of new requirements—64 in total.

  • When using v4.0, only 13 out of 64 are mandatory.
  • Until March 2025 additional 51 remain “best practices”; after the retirement of v3.2.1, it will be mandatory to complete a PCI DSS assessment.

Changes in the Security Objective of PCI-DSS v4.0?

PCI-DSS v3.2.1 PCI-DSS v4.0
Build and Maintain Secure Network and Systems
Build and Maintain Secure Network and Systems
Protect Card Holder Data

Protect Account Data

Maintain a Vulnerability Management Program
Maintain a Vulnerability Management Program
Implement Strong Access Control Measures
Implement Strong Access Control Measures
Regularly Monitor and Test Networks
Regularly Monitor and Test Networks
Maintain an Information Security Policy
Maintain an Information Security Policy

Change in the Names of 12 PCI-DSS v4.0 Requirements

PCI-DSS v3.2.1 PCI-DSS v4.0
Install and maintain a firewall configuration to protect cardholder data

Install and maintain Network Security Control

Do not use vendor-supplied defaults for system passwords and other security parameters

Apply secure configuration to all system components

Protect stored cardholder data

Protect stored account data

Encrypt transmission of cardholder data across open, public networks

Protect cardholder data with strong cryptography during transmission over open public networks

Use and regularly update anti-virus software or programs

Protect all systems and network from malicious software

Develop and maintain secure systems and applications

Develop and maintain secure systems and software

Restrict access to cardholder data by business need to know

Restrict access to system components and cardholder data by business need to know

Assign a unique ID to each person with computer access

Identify users and authenticate access to system component

Restrict physical access to cardholder data
Restrict physical access to cardholder data
Track and monitor all access to network resources and cardholder data

Log and monitor all access to system component and cardholder data

Regularly test security systems and processes

Test security systems and networks regularly

Maintain a policy that addresses information security for all personnel

Support information security with organizational policies and programs

Type of Changes

Change Type Description

Evolving Requirements

This change is to make sure that the standard is up to date with emerging threats, technologies and changes in the Payment industry.

Clarification or Guidance

Updated wording, explanation, definition, and guidance to increase understanding.

Structure or Format

Reorganization of content.

Two Approaches

New flexibility has been provided for organizations to satisfy the PCI DSS security objectives. The two distinct techniques for PCI DSS evaluations that will be permitted under version 4.0 demonstrate this flexibility:

  1. Defined Approach- The organization is expected to comply with the stated requirements, and assessors will conduct testing procedures as mentioned within the standard.To fill gaps, compensating controls are implemented. This has been consistent since the release of PCI-DSS v3.0.

  2. Customized Approach- There is no written testing procedure to be followed by assessors, and the testing procedure will be developed by the assessor to validate the solution the entity has implemented. This approach is focused on “risk mature entities”.

Adobe’s Common Controls Framework of Industry-acclaimed security standards

Today’s world is an ever-changing scenario with changes to the technology sector happening more frequently than ever due to emerging technologies. The case is quite similar in the field of Cyber Security. There are a few industry-acclaimed cybersecurity standards for governing the processes and execution of these standards. These standards are usually built upon a framework of control objectives that need to be implemented by the organizations to comply with these standards. Compliance is measured in terms of control objectives meeting the compliance criteria and also other regulatory and statutory criteria.

Since most of these Cybersecurity standards speak of similar control objectives or lay emphasis on similar control areas, it is advisable to have the ‘Adobe’s Common Control Framework’, which means that if we are able to comply with a single requirement from a particular framework, in theory, we should be able to use the adherence of that requirement for ALL the similar frameworks. There are several approaches to achieving this Adobe’s Common Controls Framework both in theory and in practice and will be discussed in detail later on in this article. The most relevant security and privacy frameworks are ISO 27001, NIST, PCIDSS, GDPR, SOC Type 2.

There is a significant overlap of controls contained in these standards as all of these standards primarily deal with one requirement which is the protection of data. Protection of information from unauthorized disclosure, compromise, and theft forms the backbone or the building blocks of an Adobe’s Common Control Framework. This leverages the fact that similar controls or that the essence of the controls is the same across standards and can be used to gauge the adherence or compliance of an organization to the standard. In actual execution, while gauging the compliance of an organization, the Adobe’s Common Controls Framework is not only holistic but can reduce the effort and cost otherwise required by the organization to comply with individual standards.

There are two methods of developing the Adobe’s Common Control Framework for an organization and there are very subtle differences between the two methods. They are Controls harmonization and Controls Mapping.

Controls Harmonization:

Harmonization is the creation of a brand-new control language set from several source languages of standards taking into consideration content & context. In theory, the intent and meaning of the words and sentences remain intact, but the language and actual words of the individual standards have been changed with a new harmonized meaning defined. To achieve the usage of a single language as an industry, globally, it would have significant benefits and it would be the most efficient way to operate not only as security professionals but also as humans. Adobe’s Common Control Framework is an example of this type of construct. The benefits of having a single operating language can truly be amazing in terms of effort reduction and cost reduction.

Control Mapping:

Today, most brilliant and forward-thinking security professionals are using the control mapping method. The main idea behind this method is to keep the original language intact as much as possible while mapping and matching the intent and meaning of each sentence and word. This is the most practical and realistic approach because this is how humans fundamentally interact with each other globally. One can see this working in real life where two different languages are being spoken by individuals and kept mainly intact, but an interpreter or linguist is translating between the two — the map is developed in the mind of the linguist.

Some real-life examples of mapping for cybersecurity frameworks can be seen in HITRUST Framework, Cloud Security Alliance Framework, and even the U.S. Government formally uses mapping in NIST SP 800-53 Appendix H – NIST RMF to ISO 27001 Mapping Table. The benefits of control mapping are that it allows one to actually break away from a single monolithic language that is brittle when a new regulation is introduced. Control mapping is more holistic and comprehensive and aids the security professional in having a wider spectrum while implementing controls.

By now, as we have seen multiple security frameworks with rapidly emerging requirements are nothing but redundancy in controls across frameworks. Hence the way forward especially for a security consulting organization is to develop the Adobe’s Common Control Framework to gauge it’s client’s security posture comprehensively. Security risk and compliance teams are in a constant state of flux as they struggle to keep up with the ever-emerging regulations of a security framework or standard. Hence to restore stability in daily operations of compliance and security professionals, the Adobe’s Common Controls Framework is not only a savior but a game-changer too.

At Accorian, we are always committed to providing the best feasible security solution to our partners and clients as part of our service delivery. We apply Adobe Common Controls Framework (CCF) derived from multiple standards like ISO27001, PCIDSS, NIST, GDPR to gauge the security posture of an organization. Technically speaking our consultants at Accorian use Adobe Common Controls Framework (CCF) to conduct security maturity assessments of large and medium scale enterprises which in turn aid the consultants to draw out roadmaps for the elevation of the maturity level and the strategy involved in achieving it.

Shukla CPA, d.b.a Accorian Assurance is a licensed, certified public accounting firm registered with the American Institute of Pubic Accountants (AICPA) and the Public Company Accounting Oversight Board (PCAOB). Esha IT Corp d.b.a Accorian is a global leader in cybersecurity and compliance professional services.

© 2023 Accorian. All Rights Reserved.

    Ready to Start?

    Download Case study

    Download SOC2 Guide

    Human Resources Director

    Posted On: 09 May, 2022

    Drop your CVs to joinourteam@accorian.com

      Interested Position
      First Name
      Last Name
      Email
      Total Experience
      Mobile Number
      Upload Resume