[Autogenerated] there have always been some requirements
in Pc ideas that only apply to third party service
providers or as we now call them T.
P.
S.
P.
S.
Version four of the standard also has some new
requirements that only apply to T.
P.
S.
P.
S.
The first is a small change to the cryptographic architecture
documentation that service providers have to maintain and it is to
ensure the separation of keys between production and non production
environments and that that is in place.
And it's documented the second requirement that just applies to TP SPS,
is that their intruder detection system or intruder prevention system.
So the IDs or the hips,
that it monitors covert channels for attacker activity and
what's an example of a covert channel, something like the domain name service.
The next new requirement for TP SPS is they need to make sure that
any merchants who use their services are either able or allowed to
do ___________ testing or alternatively,
that the service provider will provide evidence to the merchant that
the service provider has had a ___________ test done themselves and
could show evidence of that to the merchant.
Because the PCs sc has heard that some service providers are,
Let's say not entirely helpful when their customers are trying to
validate their own compliance with the requirement 12.8,
There are new requirements in 12.9 to ensure that service providers give
information to merchants to allow the merchant to be compliant.
That includes providing information about the service providers level
of compliance if they provide a function or a service and then also
which requirements are going to be the T.
P.
S.
P.
S.
Responsibility,
Which requirements are going to be the merchant's responsibility and
importantly now which are shared responsibilities And this mirrors the change
to requirement 12.8.5 that the merchant will be completing.
I've covered what I think are all the major changes to the
standard that will require organizations to undertake a
substantial amount of work or expenditure to meet.
I want to repeat what I said at the beginning of this section,
I've just picked out the major changes.
I haven't covered all of them.
All of the new requirements are detailed in this really helpful summary of
changes document which I urge you to download from the PCs sees document
library which you can find on the pc sc website