Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Compliance

PCI Security Standards Council Releases Version 2.0 of PCI DSS and PA-DSS

The PCI Security Standards Council (PCI SSC), the industry standards body that oversees the Payment Card Industry Data Security Standard (PCI DSS), PIN Transaction Security (PTS) requirements and the Payment Application Data Security Standard (PA-DSS), this week released version 2.0 of the PCI DSS and PA-DSS.

The PCI Security Standards Council (PCI SSC), the industry standards body that oversees the Payment Card Industry Data Security Standard (PCI DSS), PIN Transaction Security (PTS) requirements and the Payment Application Data Security Standard (PA-DSS), this week released version 2.0 of the PCI DSS and PA-DSS.

A recent report from Verizon on compliance with the Payment Card Industry Data Security Standard (PCI DSS) revealed that only 22 percent of the organizations assessed were PCI compliant at the time of their initial examination. But compliance is worth the trouble. According to the report, organizations that suffer credit card data breaches are 50 percent less likely to be PCI compliant.

PCI Security Standards Council Logo

This latest version is designed to provide greater clarity and flexibility to facilitate improved understanding of the requirements and eased implementation for merchants. Version 2.0 becomes effective on January 1, 2011, but validation against the previous version of the standard (1.2.1) will be allowed until December 31, 2011, giving organizations more time to understand and implement the updated standards and provide feedback throughout the process. After January 1, 2012, all assessments must be under version 2.0 of the standards.

PCI DDS v2.0 – What Your QSAs Will be Looking For

Fortunately, Version 2.0 doesn’t introduce any new major requirements. The majority of changes are modifications to the language, which clarify the meaning of the requirements and make understanding and adoption easier for merchants. Key revisions serve to reinforce the need for a thorough scoping exercise prior to assessment in order to understand where cardholder data resides; promote more effective log management in securing cardholder data; allow organizations to adopt a risk-based approach when assessing and prioritizing vulnerabilities that is based on their specific business circumstances; and accommodate the unique environments of small merchants to simplify their compliance efforts.

“The nature of the changes is a testament to the strength and growing global maturity of the standards as a framework for securing cardholder data,” said Bob Russo, general manager of the Council. “I want to thank each and every individual and organization who contributed to the development of these standards. It’s their input that’s critical in making the PCI Security Standards an excellent baseline for protecting payment card data.”

In addition to the standards documents, the Council has also launched a new website with updated materials and navigational tools aimed at providing its diverse stakeholders with the targeted information they need to understand the standards and how to apply them in their organizations. As part of a broader initiative to help small merchants develop their PCI security programs, it also includes a dedicated site for this key group with resources to address their unique environments.

The release of version 2.0 begins the new three year lifecycle for standards development, which streamlines the development process by aligning DSS, PA-DSS and PTS on a similar three year schedule. The lifecycle also allows for minor revisions or errata to be issued throughout the cycle as necessary.

Advertisement. Scroll to continue reading.

The standards, detailed summary of changes and supporting documentation can be found at https://www.pcisecuritystandards.org/security_standards/documents.php

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how the LOtL threat landscape has evolved, why traditional endpoint hardening methods fall short, and how adaptive, user-aware approaches can reduce risk.

Register

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

People on the Move

SAP security firm SecurityBridge announced the appointment of Roman Schubiger as the company’s new CRO.

Cybersecurity training and simulations provider SimSpace has appointed Peter Lee as Chief Executive Officer.

Orchid Security has appointed a new Chief Product Officer and three advisors.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.