{"id":48492,"date":"2024-04-02T14:42:43","date_gmt":"2024-04-02T12:42:43","guid":{"rendered":"https:\/\/www.usd.de\/?p=48492"},"modified":"2024-04-11T09:24:51","modified_gmt":"2024-04-11T07:24:51","slug":"pci-dss-v4-transition-phase-ends","status":"publish","type":"post","link":"https:\/\/www.usd.de\/en\/pci-dss-v4-transition-phase-ends\/","title":{"rendered":"PCI DSS v4.0: The Transition Phase Is Over. What Will Change for You?"},"content":{"rendered":"\n

On March 31, 2024, the previous version 3.2.1 of the Payment Card Industry Data Security Standard (PCI DSS) expired. While companies were able to decide for themselves which version of the standard to base their PCI assessment on during the two-year transition phase, the guideline has been clear: since April 1, 2024, all assessments for the annual review of PCI DSS compliance must be carried out in accordance with version 4.0.<\/p>\n\n\n\n

Are you facing your first PCI DSS v4.0 assessment this year? Are you wondering what will change for you? In this blog post, we give you a brief overview:<\/p>\n\n\n\n

<\/div>\n\n\n\n

Are PCI DSS v4.0 assessments different?<\/h2>\n\n\n\n

No, the assessment process remains essentially the same. Planning, conducting and dealing with findings will not change with the new version. Our assessors will continue to start with a kick-off and may request initial documents as part of the assessment planning before the actual assessment is carried out. Assessments may continue to be carried out remotely, provided the environment under assessment allows it.<\/p>\n\n\n\n

Most of the changes can be found in the relevant documentation, the evidences and, of course, in the requirements themselves.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Update of RoC and AoC<\/h2>\n\n\n\n

After successful completion of the assessment, your QSA will create a \"Report on Compliance\" (RoC) and an \"Attestation of Compliance\" (AoC) for you to prove compliance with the PCI DSS. These two documents have been revised as part of the new version 4.0, but their structure has remained the same. Your PCI assessor is already using the new templates, so there is no need for you to familiarize yourself with the revised documents.<\/p>\n\n\n\n

<\/div>\n\n\n\n

More detailed evidence required<\/h2>\n\n\n\n

The RoC describes how the individual PCI DSS requirements are implemented in your company, i.e. the security situation, the environment, the systems and the protection of cardholder data in your company. It also documents how the PCI assessor proceeded when checking the respective requirement.<\/p>\n\n\n\n

PCI DSS v4.0 will require more detailed evidence in the RoC from now on. Confirmation of compliance will no longer be sufficient, but references to specific configurations, screenshots or documentation will also be required. Example: While it was previously sufficient for your assessor to confirm that your company complies with the requirement for a minimum password length, the PCI DSS v4.0 RoC now requires proof that this is enforced.<\/p>\n\n\n\n

<\/div>\n\n\n\n

New requirements<\/h2>\n\n\n\n

A total of 64 new requirements were introduced with version 4.0. Only a comparatively small number, specifically 13 requirements, have become mandatory as of April 1, 2024. These must be implemented in time for your next assessment if they have not already been implemented.<\/p>\n\n\n\n

The remaining new security requirements in PCI DSS v4.0 are marked as \"future-dated\". The PCI Council<\/a> has granted an additional year to implement these requirements. However, these must also be fully implemented as described in the standard by March 31, 2025 at the latest. Until these requirements officially come into effect, they count as best practice.<\/p>\n\n\n\n

What does this mean for you? Your PCI assessor will discuss the status of implementation in the next assessment, but will only document recommendations rather than a finding in the event of non-compliance or insufficient compliance. While this might sound reassuring for now, we recommend that you start reviewing and implementing future-dated requirements in good time, as some of these will require quite some effort and have significant consequences.<\/p>\n\n\n\n

The following future-dated requirements, for example, require extensive implementation:<\/p>\n\n\n\n

<\/p>\n\n\n\n