Increased Scanning Requirements in PCI DSS v4.0: usd Invites Acquirers to an Exchange of Experiences

22. November 2023

For many companies in the payment industry, preparations for PCI DSS v4.0 are reaching the final stage. This is also the case for Acquirers, payment institutions that process card payments for merchants, and their customers. As solutions to shared challenges can be better found together, usd has been inviting representatives of European Acquirers to exchange experiences and knowledge for many years.

"The format is characterized by the transparent presentation of current implementation possibilities and the presentation of various options. The opportunity to ask individual questions rounds off the event and enables an interactive exchange," says Patricia Brenner, Scheme Projects Manager, VR Payment GmbH.

On November 9, it was time again. The most important topic on the agenda was PCI DSS v4.0 and the implementation of the new security requirements for SAQ A merchants. According to the latest version of the standard, the majority of merchants will be obliged to have external security scans carried out regularly by accredited providers (ASV) starting in April 2024. With this tightening of the scanning obligation, the PCI Council is responding to the constantly growing threat of web skimming attacks, among other things.

Susanne Pfitzner, Service Manager for usd Security Platforms, understands the challenges that this new requirement poses for Acquirers and their customers: "As you can imagine, many merchants who have never had to conduct security scans before have neither much understanding of the new requirement nor sufficient resources. It is therefore important for their Acquirers to offer practicable solutions. Of course, we won't leave them on their own."

The agenda of the usd Acquirer Meeting therefore included a presentation of new and planned future features of the usd PCI Compliance Management Platform as well as a detailed block on the topic of the extended scanning obligation for merchants with SAQ Type A. In addition to various options for dealing with the scanning obligation, Acquirers were also given suggestions for communicating with their merchants.

"The presentations provided a very informative overview of the challenges for SAQ A merchants in PCI DSS v4.0 and in particular helped to understand the new requirement to carry out vulnerability scans," summarizes Jörg Michael, Business Analyst Payment Products, PAYONE GmbH. "Many thanks to the usd team, as a participant I was well understood and actively involved."

Also interesting:

Setting off for DORA – Your Preparation in 3 Steps

Setting off for DORA – Your Preparation in 3 Steps

DORA, the Digital Operational Resilience Act, is currently keeping the entire European financial sector on tenterhooks. The European Commission's regulation is accompanied by extensive requirements for digital resilience and there is less than a year left to implement...

What Cyber Security Has to Do with Your Annual Financial Statements

What Cyber Security Has to Do with Your Annual Financial Statements

Inadequate cyber security is one of the biggest risks for companies today. This is the assessment of the World Economic Forum, which ranks cyber insecurity as the fourth biggest risk for the next two years in its Global Risks Report 2024. That is why cyber security...

Categories

Categories