[Autogenerated] in this module,
we're going to discover the major new requirements in pc IDs S four,
I have not included every single new requirement,
just those that I think will have the most impact on organizations.
There are a total of 64 brand new requirements.
53 applied to all organizations and 11 adjust for service providers,
they are all listed in this really good document provided by the council,
which is a summary of changes document which you can
download from the PCs see document,
library on the pc SSC website first There are 30 new
policy and process type requirements and because they
won't require capital expenditure,
these come into force at the same time as the standard,
So they'll need to be in place for any assessments
conducted on or after one April 2024.
This first new requirement is actually repeated 12 times
once in each principal requirement, it's always requirement .1.2.
So in principle, requirement seven, for example,
it will be 7.1.2 and the demand is that the specific roles and
responsibilities for performing all the activities in each of the
requirements is assigned to a role or to an individual.
The idea is to make sure that not only has the entity
decided to perform the requirement,
but there's someone responsible for it happening and also that that person
responsible knows it's part of their role in the guidance.
It suggested that building a responsibility assignment matrix that
includes his responsible accountable consultant informed or a racy
matrix for each requirement will be good practice.
So that is 12 new requirements that come into effect with the
standard and they're all essentially the same.
However,
the 13th new requirement that also comes into effect when the standard is the
only one that you can assess against is quite different.
This is a requirement for organizations to document and confirm the
scope of the systems processes and technology that pea seeds supplies to
and this needs to be done on an annual basis.
It's always been the case that the assessor had to confirm an
organization's scope when they did the annual assessment.
But this new requirement is different.
The organization,
not the assessor has to document cardholder data flows and
therefore all locations where data is stored,
processed or transmitted.
It must identify all the segmentation controls and all the
systems that could affect the security of the cardholder data
environment including 3rd parties.
Essentially it's a requirement to do the scope assessment that
most organizations did when they started their pc IDs s
journey but do it on an annual basis.
People may criticize this as busywork but my experience is that actually if
you do have a formal reassessment of your scope annually,
you can find new business processes that have slipped through change
control and sometimes that means your cardholder data environment
isn't well what you thought it was and at the end of the day if you
don't know your environment, you can't protect your environment.
There's a further wrinkle here for service providers That this
requirement also contains a future dated part,
which means that after one April 2025,
service providers would have to do this confirmation
of scope exercise every six months.
The PCI SSC anticipates the rest of the new requirements in the
standard will require expenditure by an organization,
which is why they're all future dated.
Although the standard is the only one that can be used from one April 2024.
These new future dated requirements do not need to be in place until the
first assessment an entity has on or after one April 2025.
If a new requirement is future dated,
this is indicated in the applicability notes section of the
requirements along with a comment that it would actually be good
practice to do it before the deadline.
I want to start off with a change that really isn't the change,
it's made out to be.
You seem you hear people say now that P C I.
D.
S.
Version four allows you to take a risk based approach because at
various places in the standard you can do what's called a targeted risk
analysis and the targeted risk analysis allows a degree of flexibility
in how a requirement is implemented,
targeted risk analysis is mainly used so that an organization can
determine how frequently it undertakes a task.
Um for example,
allowing an organization to determine how frequently they inspect
physical points of interaction to detect tampering the targeted risk
analysis is also required anytime you decide to use the customized
approach rather than the defined approach.
And we're going to talk about that in a later module.
So this is less of a major change that I guess many people hoped it would be.
Rather than going through requirement by requirement,
I grouped the major changes into logical sections and these are cryptography,
e commerce, identity and access control,
logging and vulnerability management protection against phishing
and then some management type of requirements.
And then finally there are new requirements that
only apply to service providers.
First off,
we are going to look at the changes to the
requirements concerned with cryptography.