Due to the nature of the evolving PCI DSS 4.0 timeline, this post has been revised from the original article by author Tony Fulda.
The PCI DSS 4.0 draft was recently released in a draft state to key stakeholders for review. These stakeholders include QSA companies, approved scanning vendors, and participating organizations. The PCI Council expects to officially release PCI DSS 4.0 along with its associated validation documents in March 2022, and then the real journey begins!
As one of the lucky stakeholders to receive a first look at the draft, we're eager to start helping but we are still under an NDA so the guidance we can give is limited right now. Our Clients are looking ahead and asking questions about the potential impact the new Standard will have on their compliance programs. Some of the top questions we are getting are:
The answers to these questions come down to an easy answer - it depends! Each Client has a unique environment that needs to be assessed to determine the areas where most help will be needed. As such, assessments will likely take longer and therefore the cost of an assessment will increase.
Source: www.pcistandards.org
When considering timing, the first step of the process is training. No QSA can perform a PCI 4.0 assessment until they have gone through the training, and at this point, training is set to occur in Q2 of 2022. This means your organization cannot assess against the standard until this training is completed.
The PCI DSS v3.2.1 Standard is set to retire in Q1 2024 which means your organization isn't required to move to v4.0 until then, giving you a long runway. Given the timeline above, you can be assessed against v4.0 anytime between Q2 2022 and Q1 2024.
To go along with the “PCI Road Trip” metaphor we’ve been using internally to describe the new Standard, Online has been working diligently behind the scenes to develop new 4.0-based services that will help you get your compliance program tuned up for the journey ahead.
The new Standard has some easy and obvious incremental tweaks that will be fairly straightforward to address, and some more significant changes that will stretch a lot of organization’s abilities.
Team Online has spent a lot of time reviewing the Draft Standard to sort out these “small bumps” from the “giant pothole” requirements. At this stage, our analysis has identified over 60 new or changed DSS requirements that are going to involve some (or a lot of) action on the part of many organizations. In response, we’ve put together our 4.0 Gap Assessment toolbox, which is shaping up to be the quickest way to identify which changes are going to impact your organization the most.
Mapping the changes to your unique environment is a good start, but then what? For those of you that have worked with our QSA team before, you already know that our PCI “Expert Collective” is not apt to find an issue and walk away – we’re all about teaming up with our Clients to solve business problems by integrating security and compliance into real-world programs. After we perform the review of your environment against the changes, we will provide actionable recommendations to help you determine how to best address any noted gaps with the new Standard; the end result will help you prioritize the scope, reach, impact, and effort required to address both the minor and significant changes.
For those that need guidance, we’ll work with you to develop risk- and budget-appropriate strategies and tactics for implementation based on your specific security goals and business requirements. Our process will give you answers to the questions that concern your business the most so that you can make informed decisions to future-proof your compliance program.
The SSC has put a particular emphasis in the last few years on taking a ‘Business as Usual’ (BAU) approach to PCI compliance, and our expectation is that 4.0 will follow this pattern. If the Council is true to form, the BAU requirements will receive more attention, and we expect the Standard may have a number of updates to ensure that organizations keep their hands on the wheel. There have always been time-based requirements (think quarterly scans, annual policy reviews, etc.), but it’s a strong possibility that multiple requirements may have ‘BAU’ language baked into the testing procedures - this could mean that organizations will be required to provide evidence that time-based requirements are formalized, monitored, and effectively addressed on a continuous basis. For organizations that have a lot of ad hoc processes, limited staff tasked with ‘maintenance mode’ activities, or no access to time travel technologies, additional BAU requirements could present some real challenges.
Online can help you identify which time-based and BAU requirements apply to your environment, and then work with you to assess your technical and process-based monitoring/alerting/response capabilities; the end result is a clear roadmap for effective security and program maintenance. Our goal is always to help our clients find the right solutions for continuous security improvement and maturity; building out BAU-based programs is perfectly aligned with our philosophy and core capabilities.
There are several great places to start your journey:
Register for an upcoming event that Online is hosting for our clients within 1 week of the Council publishing the Standard in March 2022. In this session, you can expect the following:
It’s one thing to change a tire, and yet another to change out a timing belt or fuel pump! Once the Standard has been officially released, Online will publish information on some of the services we will offer to assist our Clients with some of the heavier lifts in this journey to v4.0 compliance.
We look forward to talking with you in March and assisting you on this journey.