PCI 3.0 Now In Full Effect
Tweet

Monday, 1st June, 2015
17:38pm

PCI 3.0 has been applied to all PCI servers, PCI 3.0 requirements are now in full effect. Regarding PCI 3.0 with questions. Host 99 will not fully enforce PCI 3.0 for all PCI Shared, VPS and Dedicated Servers. We will monitor for any non compliance and reports will be made regarding logs and findings. Please contact your ASV for more information.

Based on feedback from the industry, in 2010 the Council moved from a two-year to a three-year standards development life cycle.The additional year provides a longer period to gather feedback and more time for organizations to implement changes before a new version is released.

Version 3.0 will introduce more changes than Version 2.0. The core 12 security areas remain the same, but the updates will include several new sub-requirements that did not exist previously. Recognizing that additional time may be necessary to implement some of these sub-requirements, the Council will introduce future implementation dates accordingly. This means until 1 July 2015 some of these sub-requirements will be best practices only, to allow organizations more flexibility in planning for and adapting to these changes.

Additionally, while entities are encouraged to begin implementation of the new version of the Standards as soon as possible, to ensure adequate time for the transition, Version 2.0 will remain active until 31 December 2014. The nature of the changes reflects the growing maturity of the payment security industry since the Council’s formation in 2006, and the strength of the PCI Standards as a framework for protecting cardholder data.

Cardholder data continues to be a target for criminals. Lack of education and awareness around payment security and poor implementation and maintenance of the PCI Standards leads to many of the security breaches happening today. The updates address these challenges by building in additional guidance and clarification on the intent of the requirements and ways to meet them. Additionally, the changes in PCI DSS and PA-DSS 3.0 focus on some of the most frequently seen threats and risks that precipitate incidents of cardholder-data compromise.

The updated standards will help organization s not by making the requirements more prescriptive, but by adding more flexibility and guidance for integrating card security into their business-as-usual activities. At the same time, the changes will provide increased stringency for validating that these controls have been implemented properly, with more rigorous and specific testing procedures that clarify the level of validation the assessor is expected to perform. Overall, the changes are designed to give organizations a strong but flexible security architecture with principles that can be applied to their unique technology, payment, and business environments.The updated versions of PCI DSS and PA-DSS will:

Provide stronger focus on some of the greater risk areas in the threat environment
Provide in creased clarity on PCI DSS & PA-DSS requirements
Build greater understanding on the intent of the requirements and how to apply them
Improve flexibility for all entities implementing, assessing, and building to the Standards
Drive more consistency among assessors
Help manage evolving risks / threats Align with changes in industry best practices Clarify scoping and reporting Eliminate redundant sub
-requirements and consolidate documentation

Back

By Month

By Month

Support

PCI 3.0 Now In Full Effect
Tweet

Support

By Month

By Month

Support

PCI 3.0 Now In Full Effect Tweet

Support

Generate Password

PCI 3.0 Now In Full Effect
Tweet