By Héctor Guillermo Martínez, President of GM Sectec
With the release of a new version of the PCI DSS 4.0 Payment Card Industry Data Security Standard, the safety and security requirements for credit and debit card transactions worldwide have been updated. Is your business ready for PCI DSS 4.0 adoption?
PCI DSS 4.0 is the next version of the Payment Card Industry Data Security Standard, which is a set of security requirements that companies that process, transmit, or store payment card information must meet to protect that information and prevent credit and debit card fraud.
Version 4.0 was released in March 2022, which introduced some significant improvements in security and efficacy over PCI DSS version 3.2.1. Its official implementation is scheduled for 2024, although the increased requirements will come into force in 2025.
Expected changes include a more focused focus on security goals, greater flexibility to allow for different forms of compliance, new requirements for multi-factor authentication and online security, and an increased emphasis on risk assessment and ongoing security assessment.
Compared to PCI DSS 3.2.1, PCI DSS 4.0 is expected to involve:
- Focus more on security goals and less on prescriptive controls.
- Greater flexibility to enable different forms of compliance to achieve security goals.
- Introduction of new requirements for multi-factor authentication (MFA) and online security.
- Updating definitions and terms to keep up with technological changes and trends in information security.
- Changes to compliance assessment and auditing, including the introduction of a new continuous assessment model.
- Focus on risk assessment and ongoing safety assessment.
- Increased emphasis on supply chain security and supplier management.
- Reorganization and simplification of requirements to make them easier to understand and implement.
- Increased emphasis on data privacy and protection of personal information.
- Increased emphasis on the need to maintain compliance with the standard at all times, not just during annual audits.
Accelerate the migration process
PCI DSS 4.0 is scheduled to go live in 2024. So, companies shouldn’t wait until the last minute to embark on their adoption route.
Organizations need to have an ally that provides them with technology and consulting solutions that accelerate the validation of PCI compliance across the payment model and on a global scale. With its sights set on all the challenges involved in adopting the new PCI DSS 4.0 standard, this partner must have a portfolio of services and a special certification program that supports the diagnosis, audit, consulting, and certification processes, guaranteeing optimal compliance with the standard.
With the support of the expert partner in the implementation of the standard, the key members of your team will be able to:
- Understand the changes that PCI DSS 4.0 brings to determine how they apply to your existing processes and systems.
- Perform a GAP analysis to determine current compliance with version 4.0
- Identify and plan for necessary changes to your processes and systems to comply with PCI DSS 4.0 and create an implementation plan to make these changes.
- Allocate sufficient resources for PCI DSS 4.0 implementation, including staff, time, and budget.
- Work with suppliers and partners. Companies should work with vendors and partners that accompany them with adoption methodologies that are PCI DSS 4.0 compliant and that their integration with these vendors and partners meets the requirements of the standard. We strongly suggest that you are accompanied by a company certified as a QSA to ensure that experts advise you.
- Train staff on the changes in PCI DSS 4.0 and how to comply with them.
- Perform tests and audits to ensure they are PCI DSS 4.0 compliant before official conformance assessment.
- Prepare for conformity assessment. Companies must be prepared for the official conformity assessment and ensure that they have complied with all PCI DSS 4.0 requirements before submitting to the formal assessment.
Moving from PCI DSS 3.2.1 to PCI DSS 4.0 is a significant challenge but a significant improvement in payment card data security, greater flexibility and scalability, and a more practical and risk-based approach to implementing security requirements. While it may require additional time and resources to transition, the result will be better protection for payment card data and greater peace of mind for customers and businesses
About the Author
Héctor Guillermo Martinez is President and Board Member at GM Sectec. Hector G is responsible for the growth, vision, and execution of the company. GM Sectec creates innovative tailored solutions that help accelerate business breakthroughs in the areas of cyber defense, managed detection and response services, digital forensics, multi-tenancy, business continuity, information security, automation, and process orchestration to ultimately deliver outstanding cost efficiencies to our customers and partner community. GM Sectec is a global company with Headquarters in Puerto Rico and offices in Florida, Mexico, Panama, Colombia, Brazil, Chile, Spain, and Australia with clients in over 50 countries. Hector G. has an MBA from CUNY, Zicklin School of Business, and is an alumnus of Harvard Business School.
Héctor Guillermo can be reached online at LinkedIn and in X @HGMartinez and at our company website http://www.gmsectec.com
